150 lines
5.1 KiB
YAML
150 lines
5.1 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# defaults file for ansible-role-www
|
|
www_cron_schedule: "*/15 * * * *"
|
|
www_username: test@example.com
|
|
www_password: ""
|
|
www_imap_server: imap.example.com
|
|
www_save_dir: /data
|
|
www_ftp_user: ""
|
|
www_ftp_password: ""
|
|
www_ftp_pasv_address: example.com
|
|
www_repo_url: https://git.example.com/organization/www.git
|
|
|
|
# Kubernetes deployment (existing archive, Prometheus and Tor are retained).
|
|
www_namespace: www
|
|
www_hostname: www.example.com
|
|
www_ingress_class: nginx
|
|
www_cluster_issuer: letsencrypt-prod
|
|
# Set to your published website image, including any required metrics exporter.
|
|
www_httpd_image: registry.example.com/organization/www:release
|
|
www_source_image: debian:trixie
|
|
www_repo_version: HEAD
|
|
www_rollout_revision: ""
|
|
www_archive_storage_size: 10Gi
|
|
# Enable only when the Tor controller and OnionService CRD are installed.
|
|
www_onion_enabled: false
|
|
www_wait_timeout: 600
|
|
www_image_pull_secrets: []
|
|
|
|
www_membership_enabled: false
|
|
# Build/push www/membership/Dockerfile first. Use an immutable release/digest.
|
|
www_membership_image: ""
|
|
www_membership_image_pull_policy: IfNotPresent
|
|
www_membership_replicas: 2
|
|
www_membership_worker_interval: 60
|
|
www_membership_secret_name: membership
|
|
# Empty uses an existing Kubernetes Secret. Otherwise supply via Vault/lookup.
|
|
www_membership_secret_data: {}
|
|
www_membership_ca_secret_name: ""
|
|
www_membership_resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
www_membership_worker_resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
www_membership_postgres_managed: true
|
|
www_membership_postgres_image: postgres:17
|
|
www_membership_postgres_storage_size: 10Gi
|
|
# Empty uses the cluster default StorageClass. The claim is never auto-deleted.
|
|
www_membership_postgres_storage_class: ""
|
|
www_membership_postgres_resources:
|
|
requests: {cpu: 100m, memory: 256Mi}
|
|
limits: {cpu: "2", memory: 1Gi}
|
|
www_membership_stripe_enabled: false
|
|
www_membership_shkeeper_enabled: false
|
|
www_membership_environment_overrides: {}
|
|
|
|
# Explicit effective membership level -> service group DNs. No inheritance.
|
|
# Include a group at each level that should receive it; level 0 is free-only.
|
|
# Only dedicate groups whose entire membership may be managed by this service.
|
|
www_membership_service_groups:
|
|
"0":
|
|
- "cn=Dex Users,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Discourse Users,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Gitea Users,ou=Services,dc=eom,dc=dev"
|
|
- "cn=Matrix Users,ou=Services,dc=eom,dc=dev"
|
|
"1": []
|
|
"2": []
|
|
"3":
|
|
- "cn=Mastodon Users,ou=Services,dc=eom,dc=dev"
|
|
- "cn=PeerTube Users,ou=Services,dc=eom,dc=dev"
|
|
"4": []
|
|
"5": []
|
|
|
|
# Public settings only. Credentials belong in the membership Secret.
|
|
www_membership_environment:
|
|
MEMBERSHIP_PUBLIC_URL: "https://{{ www_hostname }}"
|
|
MEMBERSHIP_ALLOW_HTTP: "0"
|
|
MEMBERSHIP_TRUST_PROXY: "1"
|
|
MEMBERSHIP_TIERS_FILE: /etc/membership/tiers/tiers.json
|
|
MEMBERSHIP_SERVICE_GROUPS_FILE: /etc/membership/tiers/service-groups.json
|
|
POSTGRES_HOST: membership-db
|
|
POSTGRES_PORT: "5432"
|
|
POSTGRES_DB: membership
|
|
POSTGRES_USER: membership
|
|
POSTGRES_SSLMODE: prefer
|
|
DEX_ISSUER: https://dex.example.com
|
|
DEX_CLIENT_ID: www-membership
|
|
DEX_CONNECTOR_ID: ldap
|
|
LDAP_URL: ldaps://ldap.example.com
|
|
LDAP_ALLOW_INSECURE: "0"
|
|
# Used only for registration/group sync, not Dex login callbacks.
|
|
# Its plaintext bind password belongs in Secret LDAP_BIND_PASSWORD, not here.
|
|
LDAP_BIND_DN: ""
|
|
LDAP_ACCOUNT_BASE_DN: ou=www,ou=people,dc=example,dc=com
|
|
LDAP_SEARCH_BASE_DN: ou=people,dc=example,dc=com
|
|
LDAP_PASSWORD_SCHEME: ""
|
|
LDAP_GROUP_PLACEHOLDER_DN: cn=membership-sentinel,ou=system,dc=example,dc=com
|
|
LDAP_CA_CERT_FILE: ""
|
|
EMAIL_HOST: ""
|
|
EMAIL_PORT: "587"
|
|
EMAIL_HOST_USER: ""
|
|
EMAIL_USE_TLS: "1"
|
|
DEFAULT_FROM_EMAIL: accounts@example.com
|
|
STRIPE_LIVE_MODE: "0"
|
|
STRIPE_PORTAL_CONFIGURATION: ""
|
|
SHKEEPER_URL: ""
|
|
SHKEEPER_CURRENCIES: ""
|
|
SHKEEPER_CA_CERT_FILE: ""
|
|
|
|
# Existing LIVE Stripe prices. Level 0 is free and is not configured as a paid tier.
|
|
# Provision the dedicated paid-group DNs separately.
|
|
# Override with {} to disable paid tiers, or test-mode prices for a sandbox.
|
|
www_membership_tiers:
|
|
level-1:
|
|
level: 1
|
|
label: Bronze
|
|
price_id: price_1Rgv4xC5KPXqTvVLfMd6z7wn
|
|
price_label: $4 USD / month
|
|
usd_amount: "4.00"
|
|
group_dn: cn=www-level-1,ou=groups,dc=eom,dc=dev
|
|
level-2:
|
|
level: 2
|
|
label: Silver
|
|
price_id: price_1Rgv5QC5KPXqTvVLv1PaHWb5
|
|
price_label: $8 USD / month
|
|
usd_amount: "8.00"
|
|
group_dn: cn=www-level-2,ou=groups,dc=eom,dc=dev
|
|
level-3:
|
|
level: 3
|
|
label: Gold
|
|
price_id: price_1Rgv5rC5KPXqTvVL8Ol8sMUf
|
|
price_label: $16 USD / month
|
|
usd_amount: "16.00"
|
|
group_dn: cn=www-level-3,ou=groups,dc=eom,dc=dev
|
|
level-4:
|
|
level: 4
|
|
label: Platinum
|
|
price_id: price_1Rgv6FC5KPXqTvVL39mAxYjm
|
|
price_label: $32 USD / month
|
|
usd_amount: "32.00"
|
|
group_dn: cn=www-level-4,ou=groups,dc=eom,dc=dev
|
|
level-5:
|
|
level: 5
|
|
label: Diamond
|
|
price_id: price_1Rgv6mC5KPXqTvVLkcmznWZa
|
|
price_label: $64 USD / month
|
|
usd_amount: "64.00"
|
|
group_dn: cn=www-level-5,ou=groups,dc=eom,dc=dev
|