Publish ITWorx Pulse source

.env.example

@@ -0,0 +1,88 @@
+# General
+PULSE_ENV=development
+PULSE_TIMEZONE=Europe/Brussels
+PULSE_DEFAULT_LOCALE=nl-BE
+PULSE_LOG_LEVEL=info
+PULSE_AUTH_MODE=mock
+
+# Public URL — select only after M0 conflict/discovery checks
+PULSE_PUBLIC_URL=http://localhost:8080
+
+# PostgreSQL
+PULSE_DATABASE_URL=postgres://pulse:pulse-dev-only@postgres:5432/pulse?sslmode=disable
+
+# Metrics source
+PULSE_PROMETHEUS_URL=http://prometheus:9090
+PULSE_PROMETHEUS_TIMEOUT=10s
+
+# Unraid — do not commit real tokens
+PULSE_UNRAID_URL=https://unraid.example.invalid
+PULSE_UNRAID_API_TOKEN=
+# Production mounts this public certificate read-only; never put a private key here.
+PULSE_UNRAID_CA_FILE_HOST=/path/to/unraid-ca.pem
+# DNS name and address of the same Unraid host as used by PULSE_UNRAID_URL.
+# Required by deploy/compose.prod.yaml; discover them instead of assuming host-gateway.
+PULSE_UNRAID_HOST_NAME=unraid.example.test
+PULSE_UNRAID_HOST_GATEWAY=192.0.2.10
+
+# OIDC / Authentik
+# Required when PULSE_AUTH_MODE=oidc; development may use the explicit mock mode above.
+PULSE_OIDC_ISSUER=https://auth.example.invalid/application/o/pulse/
+PULSE_OIDC_CLIENT_ID=pulse
+PULSE_OIDC_CLIENT_SECRET=
+PULSE_OIDC_REDIRECT_URL=http://localhost:8080/auth/callback
+# ID token claim carrying the group memberships used for role mapping.
+PULSE_OIDC_GROUPS_CLAIM=groups
+# Maps identity provider group claim values onto Pulse roles. Required in production:
+# without it no identity can be granted a role and nobody can sign in.
+# Roles: viewer, operator, editor, administrator.
+PULSE_OIDC_ROLE_MAPPING=pulse-viewer=viewer,pulse-operator=operator,pulse-editor=editor,pulse-admin=administrator
+
+# Break-glass account must be disabled unless explicitly initialized securely
+PULSE_BREAK_GLASS_ENABLED=false
+
+# pulse-agent — read-only host collector
+# Identifies the agent in every snapshot and in the protocol hello.
+PULSE_AGENT_ID=pulse-agent
+# How often a full collection pass runs (1s–5m). The scheduling loop ticks faster when
+# this is larger, so the heartbeat stays inside the healthcheck window.
+PULSE_AGENT_COLLECT_INTERVAL=10s
+# Read-only mounts of the host's kernel interfaces; compose bind mounts /proc and /sys.
+PULSE_AGENT_PROC_ROOT=/host/proc
+PULSE_AGENT_SYS_ROOT=/host/sys
+# The host name as it should appear in Pulse. Inside a container the kernel reports the
+# container's own name, so set this explicitly (for example: unraid-host).
+PULSE_AGENT_HOST_NAME=
+# Filesystem capacity and inode collection is off unless a host root is mounted
+# read-only and named here (for example /host/root together with "- /:/host/root:ro").
+# Without it the agent reports no filesystems rather than measuring its own overlay.
+PULSE_AGENT_FS_ROOT=
+# Optional cap on the process inventory (1–5000); empty uses the domain default of 1000.
+PULSE_AGENT_MAX_PROCESSES=
+
+# Liveness heartbeat file written by pulse-worker and pulse-agent after every completed
+# loop iteration. See docs/operations/WORKER_AGENT_HEALTHCHECK_CONTRACT.md.
+PULSE_HEARTBEAT_FILE=/tmp/healthy
+
+# pulse-worker — background runtime
+# data_sources UUID container discovery is attributed to. Discovery stays Disabled
+# until a source is registered, so inventory is never written against an unknown origin.
+PULSE_CONTAINER_SOURCE_ID=
+# Private/loopback CIDRs service probes may reach, comma separated (max 32).
+# Empty keeps all private space blocked. Link-local, multicast and cloud metadata
+# addresses stay blocked regardless of this value.
+PULSE_PROBE_ALLOWED_NETWORKS=
+
+# Optional real notification receiver. The URL is stored as non-secret channel
+# configuration; the bearer token remains runtime-only and is never persisted.
+# Production requires HTTPS. The receiver should deduplicate by Idempotency-Key.
+PULSE_NOTIFICATION_WEBHOOK_URL=
+PULSE_NOTIFICATION_WEBHOOK_TOKEN=
+PULSE_NOTIFICATION_WEBHOOK_TIMEOUT=10s
+
+# Production deployment (deploy/compose.prod.yaml)
+# Host port pulse-web is published on. See ADR-0011.
+PULSE_HOST_PORT=1238
+# Bind address for that port. Use 127.0.0.1 only if Nginx Proxy Manager reaches
+# Pulse over a shared Docker network rather than over the host.
+PULSE_PUBLISH_ADDRESS=0.0.0.0