65 lines
3.1 KiB
Bash
Executable File
65 lines
3.1 KiB
Bash
Executable File
# Copy to .env. Never commit real secrets. Generate each secret independently.
|
|
MEMBERSHIP_SECRET_KEY=
|
|
MEMBERSHIP_PUBLIC_URL=https://eom.dev
|
|
MEMBERSHIP_ALLOW_HTTP=0
|
|
# Safe only while membership:8000 is private and Apache overwrites headers.
|
|
MEMBERSHIP_TRUST_PROXY=1
|
|
WWW_BIND_ADDRESS=127.0.0.1
|
|
WWW_PORT=8080
|
|
POSTGRES_DB=membership
|
|
POSTGRES_USER=membership
|
|
POSTGRES_PASSWORD=
|
|
POSTGRES_HOST=membership-db
|
|
# Compose's local database is on an isolated network. For a remote database use
|
|
# verify-full and mount its trusted root certificate via PGSSLROOTCERT.
|
|
POSTGRES_SSLMODE=prefer
|
|
# Must match discovery's issuer exactly, including its trailing slash.
|
|
DEX_ISSUER=https://dex.eom.dev/
|
|
DEX_CLIENT_ID=www-membership
|
|
DEX_CLIENT_SECRET=
|
|
DEX_CONNECTOR_ID=ldap
|
|
LDAP_URL=ldaps://ldap.eom.dev
|
|
# Set to 1 ONLY with ldap:// on a trusted network to skip StartTLS.
|
|
# Bind and registration passwords will be sent unencrypted. LDAPS stays verified.
|
|
LDAP_ALLOW_INSECURE=0
|
|
# Service credentials for registration/worker group sync, not Dex login.
|
|
LDAP_BIND_DN=
|
|
LDAP_BIND_PASSWORD=
|
|
LDAP_CA_CERT_FILE=
|
|
LDAP_ACCOUNT_BASE_DN=ou=www,ou=people,dc=eom,dc=dev
|
|
LDAP_SEARCH_BASE_DN=ou=people,dc=eom,dc=dev
|
|
# Set ONLY after independently verifying slapd olcPasswordHash and password policy.
|
|
LDAP_PASSWORD_SCHEME=
|
|
LDAP_GROUP_PLACEHOLDER_DN=cn=membership-sentinel,ou=system,dc=eom,dc=dev
|
|
EMAIL_HOST=
|
|
EMAIL_PORT=587
|
|
EMAIL_HOST_USER=
|
|
EMAIL_HOST_PASSWORD=
|
|
EMAIL_USE_TLS=1
|
|
DEFAULT_FROM_EMAIL=accounts@eom.dev
|
|
STRIPE_SECRET_KEY=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
STRIPE_LIVE_MODE=1
|
|
STRIPE_PORTAL_CONFIGURATION=
|
|
# Optional SHKeeper prepaid crypto. Leave empty to hide/disable new invoices.
|
|
# HTTPS only; use your actual origin (not an API path or a user-supplied URL).
|
|
SHKEEPER_URL=
|
|
SHKEEPER_API_KEY=
|
|
# Comma-separated API crypto identifiers actually enabled on your instance:
|
|
# SHKEEPER_CURRENCIES=BTC,LTC,XMR,ETH-USDT
|
|
SHKEEPER_CURRENCIES=
|
|
# Mount a private CA read-only into web + worker if needed. Never disable TLS.
|
|
SHKEEPER_CA_CERT_FILE=
|
|
# Set real recurring Stripe Price IDs and pre-created dedicated LDAP groups.
|
|
# The display price is informational; Stripe Checkout is authoritative.
|
|
MEMBERSHIP_TIERS_FILE=/app/tiers.eom.json
|
|
# Explicit effective level -> list of additional service group DNs, including 0.
|
|
# Empty lists grant nothing; no inheritance. Pre-create dedicated LDAP groups.
|
|
MEMBERSHIP_SERVICE_GROUPS_FILE=/app/service-groups.eom.json
|
|
# MEMBERSHIP_SERVICE_GROUPS_JSON overrides the file, e.g. {"0":["cn=community,ou=groups,dc=example,dc=org"],"1":["cn=community,ou=groups,dc=example,dc=org","cn=members-chat,ou=groups,dc=example,dc=org"]}
|
|
# These are existing LIVE-mode prices; use separate test-mode prices in sandbox.
|
|
# Set MEMBERSHIP_TIERS_JSON instead to override the file ({} disables paid tiers).
|
|
# Each configured paid tier needs a unique positive level (level 0 is free).
|
|
# Example shape (names/prices/group DNs are your choice, not created by the app):
|
|
# MEMBERSHIP_TIERS_JSON={"level-1":{"level":1,"label":"Bronze","price_id":"price_REPLACE","price_label":"$5 / month","group_dn":"cn=www-level-1,ou=groups,dc=eom,dc=dev","description":"Back the next experiment in the eom.dev lab."}}
|