ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
89 lines
4.0 KiB
Bash
89 lines
4.0 KiB
Bash
# General
|
||
PULSE_ENV=development
|
||
PULSE_TIMEZONE=Europe/Brussels
|
||
PULSE_DEFAULT_LOCALE=nl-BE
|
||
PULSE_LOG_LEVEL=info
|
||
PULSE_AUTH_MODE=mock
|
||
|
||
# Public URL — select only after M0 conflict/discovery checks
|
||
PULSE_PUBLIC_URL=http://localhost:8080
|
||
|
||
# PostgreSQL
|
||
PULSE_DATABASE_URL=postgres://pulse:pulse-dev-only@postgres:5432/pulse?sslmode=disable
|
||
|
||
# Metrics source
|
||
PULSE_PROMETHEUS_URL=http://prometheus:9090
|
||
PULSE_PROMETHEUS_TIMEOUT=10s
|
||
|
||
# Unraid — do not commit real tokens
|
||
PULSE_UNRAID_URL=https://unraid.example.invalid
|
||
PULSE_UNRAID_API_TOKEN=
|
||
# Production mounts this public certificate read-only; never put a private key here.
|
||
PULSE_UNRAID_CA_FILE_HOST=/path/to/unraid-ca.pem
|
||
# DNS name and address of the same Unraid host as used by PULSE_UNRAID_URL.
|
||
# Required by deploy/compose.prod.yaml; discover them instead of assuming host-gateway.
|
||
PULSE_UNRAID_HOST_NAME=unraid.example.test
|
||
PULSE_UNRAID_HOST_GATEWAY=192.0.2.10
|
||
|
||
# OIDC / Authentik
|
||
# Required when PULSE_AUTH_MODE=oidc; development may use the explicit mock mode above.
|
||
PULSE_OIDC_ISSUER=https://auth.example.invalid/application/o/pulse/
|
||
PULSE_OIDC_CLIENT_ID=pulse
|
||
PULSE_OIDC_CLIENT_SECRET=
|
||
PULSE_OIDC_REDIRECT_URL=http://localhost:8080/auth/callback
|
||
# ID token claim carrying the group memberships used for role mapping.
|
||
PULSE_OIDC_GROUPS_CLAIM=groups
|
||
# Maps identity provider group claim values onto Pulse roles. Required in production:
|
||
# without it no identity can be granted a role and nobody can sign in.
|
||
# Roles: viewer, operator, editor, administrator.
|
||
PULSE_OIDC_ROLE_MAPPING=pulse-viewer=viewer,pulse-operator=operator,pulse-editor=editor,pulse-admin=administrator
|
||
|
||
# Break-glass account must be disabled unless explicitly initialized securely
|
||
PULSE_BREAK_GLASS_ENABLED=false
|
||
|
||
# pulse-agent — read-only host collector
|
||
# Identifies the agent in every snapshot and in the protocol hello.
|
||
PULSE_AGENT_ID=pulse-agent
|
||
# How often a full collection pass runs (1s–5m). The scheduling loop ticks faster when
|
||
# this is larger, so the heartbeat stays inside the healthcheck window.
|
||
PULSE_AGENT_COLLECT_INTERVAL=10s
|
||
# Read-only mounts of the host's kernel interfaces; compose bind mounts /proc and /sys.
|
||
PULSE_AGENT_PROC_ROOT=/host/proc
|
||
PULSE_AGENT_SYS_ROOT=/host/sys
|
||
# The host name as it should appear in Pulse. Inside a container the kernel reports the
|
||
# container's own name, so set this explicitly (for example: unraid-host).
|
||
PULSE_AGENT_HOST_NAME=
|
||
# Filesystem capacity and inode collection is off unless a host root is mounted
|
||
# read-only and named here (for example /host/root together with "- /:/host/root:ro").
|
||
# Without it the agent reports no filesystems rather than measuring its own overlay.
|
||
PULSE_AGENT_FS_ROOT=
|
||
# Optional cap on the process inventory (1–5000); empty uses the domain default of 1000.
|
||
PULSE_AGENT_MAX_PROCESSES=
|
||
|
||
# Liveness heartbeat file written by pulse-worker and pulse-agent after every completed
|
||
# loop iteration. See docs/operations/WORKER_AGENT_HEALTHCHECK_CONTRACT.md.
|
||
PULSE_HEARTBEAT_FILE=/tmp/healthy
|
||
|
||
# pulse-worker — background runtime
|
||
# data_sources UUID container discovery is attributed to. Discovery stays Disabled
|
||
# until a source is registered, so inventory is never written against an unknown origin.
|
||
PULSE_CONTAINER_SOURCE_ID=
|
||
# Private/loopback CIDRs service probes may reach, comma separated (max 32).
|
||
# Empty keeps all private space blocked. Link-local, multicast and cloud metadata
|
||
# addresses stay blocked regardless of this value.
|
||
PULSE_PROBE_ALLOWED_NETWORKS=
|
||
|
||
# Optional real notification receiver. The URL is stored as non-secret channel
|
||
# configuration; the bearer token remains runtime-only and is never persisted.
|
||
# Production requires HTTPS. The receiver should deduplicate by Idempotency-Key.
|
||
PULSE_NOTIFICATION_WEBHOOK_URL=
|
||
PULSE_NOTIFICATION_WEBHOOK_TOKEN=
|
||
PULSE_NOTIFICATION_WEBHOOK_TIMEOUT=10s
|
||
|
||
# Production deployment (deploy/compose.prod.yaml)
|
||
# Host port pulse-web is published on. See ADR-0011.
|
||
PULSE_HOST_PORT=1238
|
||
# Bind address for that port. Use 127.0.0.1 only if Nginx Proxy Manager reaches
|
||
# Pulse over a shared Docker network rather than over the host.
|
||
PULSE_PUBLISH_ADDRESS=0.0.0.0
|