124 lines
5.6 KiB
Bash
124 lines
5.6 KiB
Bash
COMPOSE_PROJECT_NAME=mobilityops
|
|
MOBILITYOPS_ENV=development
|
|
MOBILITYOPS_DEMO_MODE=true
|
|
MOBILITYOPS_PUBLIC_URL=http://localhost:1228
|
|
# Build-time API origin baked into the web bundle. Leave empty: the SPA calls its own
|
|
# origin and nginx proxies /api to the API (required by the CSP connect-src 'self').
|
|
VITE_API_BASE_URL=
|
|
DATABASE_URL=postgresql+psycopg://mobilityops:mobilityops@db:5432/mobilityops
|
|
POSTGRES_DB=mobilityops
|
|
POSTGRES_USER=mobilityops
|
|
POSTGRES_PASSWORD=mobilityops
|
|
# Signs session cookies. With MOBILITYOPS_ENV=production the API refuses to start while
|
|
# this (or MOBILITYOPS_CALLBACK_TOKEN) still holds its placeholder value.
|
|
APP_SECRET=replace-in-production
|
|
TZ=Europe/Brussels
|
|
# Session cookie Secure flag. Development on localhost may use false; production startup
|
|
# requires both an HTTPS public URL and this value set to true.
|
|
SESSION_COOKIE_SECURE=false
|
|
|
|
# Optional OpenID Connect login. Public demo role buttons remain available when enabled.
|
|
OIDC_ENABLED=false
|
|
OIDC_PROVIDER_NAME=Organisatieaccount
|
|
OIDC_ISSUER_URL=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
OIDC_REDIRECT_URI=
|
|
OIDC_ALLOWED_EMAIL_DOMAINS=
|
|
OIDC_AUTO_PROVISION=true
|
|
OIDC_DEFAULT_ROLE=rental_employee
|
|
|
|
# Observability: JSON logs are always enabled. Set a token only if /metrics is exposed
|
|
# outside the private Compose network; Prometheus can send it as a bearer token.
|
|
LOG_LEVEL=INFO
|
|
# Required when the observability profile is enabled. Keep private and high entropy.
|
|
METRICS_BEARER_TOKEN=replace-me-private-metrics-token
|
|
GRAFANA_ADMIN_USER=admin
|
|
GRAFANA_ADMIN_PASSWORD=change-me-before-start
|
|
# Alertmanager sends every firing/resolved alert and the continuous watchdog to this
|
|
# owner-managed receiver. Production must route it to a channel that is actually watched.
|
|
ALERTMANAGER_WEBHOOK_URL=https://n8n.itworx.tech/webhook/mobilityops-alerts
|
|
|
|
# Verified scheduled PostgreSQL backups (Unraid override).
|
|
BACKUP_INTERVAL_SECONDS=86400
|
|
BACKUP_RETENTION_DAYS=30
|
|
BACKUP_MINIMUM_COPIES=7
|
|
# Restore the newest dump into a disposable database at least weekly. Backup health also
|
|
# requires a successful drill within eight days.
|
|
BACKUP_RESTORE_DRILL_INTERVAL_SECONDS=604800
|
|
# Set both values to copy every verified backup to an independently mounted path.
|
|
BACKUP_SECONDARY_DESTINATION=
|
|
MOBILITYOPS_BACKUP_DIR=./backups/postgres
|
|
MOBILITYOPS_BACKUP_SECONDARY_DIR=./backups/offsite
|
|
# Optional real off-site copy through the official rclone OneDrive adapter. OAuth state
|
|
# lives only in MOBILITYOPS_RCLONE_CONFIG_DIR and must never be committed.
|
|
BACKUP_OFFSITE_INTERVAL_SECONDS=900
|
|
RCLONE_ONEDRIVE_REMOTE=onedrive
|
|
RCLONE_ONEDRIVE_PATH=FleetOps/backups
|
|
MOBILITYOPS_RCLONE_CONFIG_DIR=./.secrets/rclone
|
|
MOBILITYOPS_OFFSITE_VERIFY_DIR=./backups/offsite-verify
|
|
|
|
# Privacy governance defaults.
|
|
PRIVACY_MINIMUM_BOOKING_RETENTION_DAYS=30
|
|
PRIVACY_AUDIT_RETENTION_DAYS=2555
|
|
PRIVACY_AUDIT_EXPORT_MAX_ROWS=10000
|
|
|
|
# Demo presentation (fictional org identity, badge/manifest, reset safety valve).
|
|
# DEMO_ALLOW_RESET=false permanently disables POST /api/v1/demo/reset (403), independent
|
|
# of role -- a safety valve for any environment where the dataset must not be rebuildable.
|
|
DEMO_ORGANIZATION_NAME=Northstar Mobility
|
|
DEMO_TIMEZONE=Europe/Brussels
|
|
DEMO_ALLOW_RESET=true
|
|
# Prevent public visitors from repeatedly rebuilding the shared dataset. Concurrent
|
|
# resets are always rejected using both process and PostgreSQL advisory locks.
|
|
DEMO_RESET_COOLDOWN_SECONDS=60
|
|
|
|
# Operational mode: set MOBILITYOPS_DEMO_MODE=false and provide the first manager.
|
|
# Keep these values in a secret store or an untracked production .env file.
|
|
INITIAL_ADMIN_EMAIL=
|
|
INITIAL_ADMIN_PASSWORD=
|
|
INITIAL_ADMIN_DISPLAY_NAME=Operations Manager
|
|
|
|
# n8n
|
|
N8N_BASE_URL=http://n8n:5678
|
|
N8N_WEBHOOK_URL=http://n8n:5678/webhook/mobilityops-return
|
|
N8N_ENCRYPTION_KEY=replace-me
|
|
N8N_BASIC_AUTH_ACTIVE=true
|
|
N8N_BASIC_AUTH_USER=admin
|
|
N8N_BASIC_AUTH_PASSWORD=change-me
|
|
# Recipient and sender used by the importable alert workflow. Configure real,
|
|
# monitored addresses in the deployment environment; repository defaults stay synthetic.
|
|
MOBILITYOPS_ALERT_RECIPIENT=alerts@example.test
|
|
MOBILITYOPS_ALERT_SENDER=n8n@example.test
|
|
MOBILITYOPS_CALLBACK_TOKEN=replace-me-n8n-callback-token
|
|
# Sent as the X-Fleet-Ops-Trigger-Token header when Fleet Ops calls the n8n return-
|
|
# processing webhook, so the webhook trigger can require Header Auth instead of being
|
|
# publicly callable by anyone who discovers the URL. Must match the value stored in
|
|
# n8n's "Fleet Ops Webhook Trigger Token" Header Auth credential.
|
|
MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN=replace-me-n8n-webhook-trigger-token
|
|
|
|
# RAGcore integration
|
|
KNOWLEDGE_PROVIDER=demo
|
|
RAGCORE_BASE_URL=http://ragcore-api:8000
|
|
# Optional existing Docker network used by hosted deployments to reach RAGcore through
|
|
# its private service alias instead of exposing RAGcore on the LAN.
|
|
RAGCORE_DOCKER_NETWORK=
|
|
RAGCORE_TENANT=northstar-mobility-demo
|
|
RAGCORE_WORKSPACE=mobilityops
|
|
RAGCORE_COLLECTION=internal-procedures
|
|
RAGCORE_API_TOKEN=
|
|
# UUID of the RAGcore knowledge space procedures were synced into (see workflow 3).
|
|
RAGCORE_SPACE_ID=
|
|
# Skip the slower generation endpoint temporarily after a timeout/non-2xx response and
|
|
# use the still-grounded extractive search fallback immediately.
|
|
RAGCORE_ANSWERS_CIRCUIT_BREAKER_SECONDS=60
|
|
|
|
# ITWorx MCP Hub integration. Registration itself is catalog-driven on the Hub's own
|
|
# side (it reconciles its catalog into the gateway; Fleet Ops never pushes a
|
|
# registration call) -- MCP_HUB_BASE_URL is only used here for an honest reachability
|
|
# health check surfaced on the integration status page.
|
|
MCP_HUB_REGISTRATION_ENABLED=false
|
|
MCP_HUB_BASE_URL=http://itworx-mcp-hub:8000
|
|
MCP_HUB_SERVICE_TOKEN=replace-me-mcp-hub-token
|
|
MCP_PROVIDER_ID=fleet-ops
|