go-bananas/.env.example

# go-bananas configuration.
#
# Copy to .env and edit:  cp .env.example .env
#
# Every variable is optional except where noted. The defaults are chosen so that
# `docker compose up` works with no configuration at all; this file documents what
# can be changed and shows the values the Helm chart sets in production.
#
# Two prefixes are accepted for every variable: BANANAS_<NAME> and the unprefixed
# <NAME>. The prefixed form is preferred and is what the chart uses, because an
# unprefixed name like ENVIRONMENT or LOG_LEVEL collides with other things in a
# process environment. The unprefixed form exists so that a shell running the
# binary locally does not need the prefix.

# ---------------------------------------------------------------- required --

# Nothing is strictly required to start in development. In production these become
# mandatory and the service refuses to start without them:
#
#   BANANAS_SESSION_SECRET     at least 32 bytes; signs the session cookie
#   BANANAS_PUBLIC_BASE_URL    the externally reachable origin, no trailing slash
#
# Generate a session secret with:  openssl rand -base64 48

# --------------------------------------------------------------- runtime ----

# Which authentication mode to run in: oidc, dev or none.
#
#   oidc   production. Requires an identity provider.
#   dev    a development-only bypass. Refused unless ENVIRONMENT is development,
#          so an accidentally deployed bypass is not possible.
#   none   no authentication at all; every caller is an admin. For a laptop.
BANANAS_ENVIRONMENT=development
BANANAS_AUTH_MODE=dev

# The address to listen on.
BANANAS_HTTP_ADDR=:8080

# The externally reachable origin, without a trailing slash. Used for the OIDC
# redirect URI, the absolute URLs in the runtime manifest, and the HSTS decision.
# The chart sets https://themes.example.com here.
BANANAS_PUBLIC_BASE_URL=http://localhost:8080

# Serve the admin UI under a sub-path, when it is not at the domain root.
# BANANAS_BASE_PATH=/themes

# Directory holding the built admin UI. Empty means "no UI", which is what a
# deployment that serves the UI from a CDN wants.
# BANANAS_STATIC_DIR=/srv/web

# Directory holding the built runtime SDK bundles.
# BANANAS_SDK_DIR=/srv/sdk

# ----------------------------------------------------------------- OIDC -----

# The development realm. A production deployment points this at its own provider;
# only the issuer, client credentials and group mapping are provider-specific.
BANANAS_OIDC_ISSUER=https://auth.lcl-urpi.be/realms/urpi
BANANAS_OIDC_CLIENT_ID=go-bananas
# BANANAS_OIDC_CLIENT_SECRET=read-from-a-secret

# Extra scopes beyond `openid`.
# BANANAS_OIDC_SCOPES=profile,email,groups

# Group-to-role mapping. A user in none of these groups gets the least privileged
# role, so a mapping mistake fails closed rather than open.
#
# The mock realm in deploy/dev/realm-go-bananas.json uses these names. A realm
# that uses different names will map everyone to viewer until these are corrected.
# BANANAS_OIDC_ADMIN_GROUPS=bananas-admins
# BANANAS_OIDC_EDITOR_GROUPS=bananas-editors
# BANANAS_OIDC_VIEWER_GROUPS=bananas-viewers

# Override the derived callback and logout URLs. Rarely needed: both are derived
# from PUBLIC_BASE_URL, and setting them by hand is a chance to get them wrong.
# BANANAS_OIDC_REDIRECT_URL=https://themes.example.com/auth/callback
# BANANAS_OIDC_POST_LOGOUT_REDIRECT_URL=https://themes.example.com/

# Skip TLS verification when talking to the provider. Development only, for a
# provider with a self-signed certificate; refused when ENVIRONMENT is production.
# BANANAS_OIDC_SKIP_TLS_VERIFY=false

# -------------------------------------------------------------- sessions ----

# Signs the session cookie. At least 32 bytes. Rotating it invalidates every
# session, which is the only way to revoke sessions before they expire.
# BANANAS_SESSION_SECRET=

BANANAS_SESSION_TTL=8h
BANANAS_SESSION_COOKIE_NAME=go-bananas-session
# Lax, Strict or None. None requires HTTPS, since a cross-site cookie without it
# is rejected by every current browser.
BANANAS_SESSION_SAMESITE=Lax
# Must be true whenever the service is reached over HTTPS, or the browser will
# discard the cookie and every login will appear to succeed and then fail.
BANANAS_SESSION_SECURE=false

# The role a development-bypass or anonymous caller is granted.
BANANAS_DEV_FALLBACK_ROLE=admin

# ----------------------------------------------------------- development ----

# Seed the built-in themes on first start. Safe to leave on: the seed is
# idempotent and will not overwrite a theme that has been edited.
BANANAS_SEED_ON_START=true

# ---------------------------------------------------------------- store -----

BANANAS_DATABASE_PATH=./data/go-bananas.db
BANANAS_DB_MAX_CONNS=8
BANANAS_DB_BUSY_TIMEOUT=5s

# -------------------------------------------------------------- runtime API --

# Comma-separated origins allowed to call the admin API from a browser. Empty
# means same-origin only, which is correct for the default deployment.
# BANANAS_CORS_ALLOWED_ORIGINS=

# Public origins allowed to embed the runtime SDK and load a theme. This is what
# stops a third-party site from using your instance as a free CSS CDN, so it is
# worth setting even though it defaults to the public base URL.
# BANANAS_RUNTIME_PUBLIC=

# Base URL of a CDN in front of the runtime API, if there is one. Absolute URLs in
# the manifest are rewritten to point at it.
# BANANAS_RUNTIME_CDN_BASE_URL=https://cdn.example.com

# Cache-Control for runtime responses.
BANANAS_RUNTIME_CACHE_CONTROL=public, max-age=60, stale-while-revalidate=86400

# Requests per minute per client on the public runtime API. The admin API is not
# rate limited: it is authenticated, so the user count is known and small.
BANANAS_RATE_LIMIT_PER_MINUTE=600

# -------------------------------------------------------------- http/proxy --

BANANAS_HTTP_READ_TIMEOUT=15s
BANANAS_HTTP_WRITE_TIMEOUT=30s
BANANAS_HTTP_IDLE_TIMEOUT=120s
# How long to let in-flight requests finish on SIGTERM. Must be shorter than the
# pod's terminationGracePeriodSeconds, or Kubernetes sends SIGKILL mid-request.
BANANAS_SHUTDOWN_TIMEOUT=25s

# Proxies whose X-Forwarded-For is trusted. Empty trusts none, which means every
# client looks like the proxy and the rate limiter groups everyone together. Set
# this when running behind an ingress.
# BANANAS_TRUSTED_PROXIES=10.0.0.0/8

# ---------------------------------------------------------------- logging ---

BANANAS_LOG_LEVEL=info
# json for anything a machine reads, text for a human at a terminal.
BANANAS_LOG_FORMAT=text

# ------------------------------------------------------------ diagnostics ---

BANANAS_ENABLE_METRICS=true
# The profiler registers debug handlers and must never be on in production.
BANANAS_ENABLE_PROFILER=false

# ------------------------------------------------------------- container ----

# Passed by docker-bake and goreleaser rather than set by hand.
# VERSION=dev
# COMMIT=unknown
# BUILD_DATE=unknown