Repository navigation
Expand file tree
/
Copy pathenv.example
More file actions
163 lines (144 loc) · 7.78 KB
/
Copy pathenv.example
File metadata and controls
163 lines (144 loc) · 7.78 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
# ==============================================
# OpsKnight Configuration File (.env)
# ==============================================
# 1. Copy this file to .env
# 2. Replace development values before production use.
# ==============================================
# ----------------------------------------------
# 1. DATABASE CONNECTION
# ----------------------------------------------
# Used when running the application directly on the host.
# Docker Compose builds its bundled-database URL internally; set
# OPSKNIGHT_DATABASE_URL below only when Compose should use a custom/managed DB.
DATABASE_URL="postgresql://opsknight:your_secure_password@localhost:5432/opsknight_db?sslmode=prefer&connection_limit=40"
# Optional web-only database endpoint for split deployments (for example,
# PgBouncer). Non-web roles always use DATABASE_URL.
# WEB_DATABASE_URL="postgresql://opsknight:your_secure_password@pgbouncer:6432/opsknight_db?pgbouncer=true"
# Container image tag or digest for split-runtime Docker Compose overlays.
# Required when using deploy/compose/docker-compose.split.yml (must include split-runtime role support).
# OPSKNIGHT_IMAGE="ghcr.io/opsknight-labs/opsknight:2.0.0"
# Runtime separation is normally configured by Helm/Kustomize. The scheduler
# defaults to full for compatibility; use maintenance only with all dedicated
# general, critical, bulk, runbook, and status-projector workers running.
# Runbook automation uses its own runbook-worker lane and database pool so it
# cannot queue behind or consume the critical paging worker.
DATABASE_POOL_SIZE_RUNBOOK_WORKER=3
# Set to the intended runbook worker replica count to detect lost redundancy.
# OPSKNIGHT_RUNBOOK_EXPECTED_WORKERS=2
# OPSKNIGHT_PROCESS_ROLE=integrated
# OPSKNIGHT_SCHEDULER_PROFILE=full
# Optional outbound execution Agent. Create a single-use enrollment token in
# Runbooks > Agents before starting the agent overlay. Its identity and result
# spool persist in a dedicated volume after enrollment.
# OPSKNIGHT_AGENT_IMAGE=ghcr.io/opsknight-labs/opsknight-agent@sha256:<verified-release-digest>
# OPSKNIGHT_AGENT_URL=http://opsknight-app:3000
# OPSKNIGHT_AGENT_ENROLLMENT_TOKEN=
# OPSKNIGHT_EXECUTION_PUBLIC_KEY= # Copy the pinned public key from Runbooks > Agents.
# OPSKNIGHT_EXECUTION_PUBLIC_KEYS={"default":"<current-public-key>","<next-key-id>":"<next-public-key>"}
# During rotation, use the trusted JSON key map instead of the single pin above.
# OPSKNIGHT_AGENT_POLICY_PATH=../../agent/policy.container.json
# Compressed execution artifacts are removed by reconciliation after this many days.
RUNBOOK_ARTIFACT_RETENTION_DAYS=30
# Optional Docker Compose full database URL override. Use this for managed
# PostgreSQL, TLS parameters, PgBouncer, or URI-encoded credentials, together
# with: docker compose -f deploy/compose/docker-compose.yml -f deploy/compose/docker-compose.external-db.yml up -d
# OPSKNIGHT_DATABASE_URL="postgresql://user:password@db.example.com:5432/opsknight_db?sslmode=require&connection_limit=40"
# Optional PgBouncer pooler configuration (for split runtime)
# PGBOUNCER_ENABLED=true
# PGBOUNCER_DEFAULT_POOL_SIZE=10
# PGBOUNCER_RESERVE_POOL_SIZE=5
#
# External PostgreSQL + PgBouncer structured configuration:
# PGBOUNCER_DB_HOST=db.example.com
# PGBOUNCER_DB_PORT=5432
# PGBOUNCER_DB_NAME=opsknight_db
# PGBOUNCER_DB_USER=enterprise_user
# PGBOUNCER_DB_PASSWORD=your_production_password
# PGBOUNCER_SERVER_TLS_SSLMODE=verify-full
# PGBOUNCER_SERVER_TLS_CA_FILE=/etc/ssl/certs/ca-certificates.crt
# Use an absolute host path for PGBOUNCER_TLS_CA_CERT (relative paths resolve from deploy/compose/):
# PGBOUNCER_TLS_CA_CERT=/etc/ssl/certs/enterprise-ca.crt
# ----------------------------------------------
# 2. APPLICATION SETTINGS
# ----------------------------------------------
NEXTAUTH_URL=http://localhost:3000
NEXT_PUBLIC_APP_URL=http://localhost:3000
# Number of trusted reverse-proxy entries at the right edge of X-Forwarded-For.
# Keep 1 for a single ingress/load balancer; raise only for known internal hops.
TRUSTED_PROXY_HOPS=1
TRUST_PROXY_HEADERS=false
# Which forwarded header the ingress is trusted to set. Default: X-Forwarded-For (read from the
# right, TRUSTED_PROXY_HOPS entries in). CF-Connecting-IP is honoured ONLY when selected here
# (cf-connecting-ip), because behind any non-Cloudflare ingress a client can send it.
# TRUSTED_PROXY_HEADER=x-forwarded-for
# Optional addresses/CIDRs of the ingress. When set and the peer address is known, only those
# peers' forwarded headers are trusted even if TRUST_PROXY_HEADERS=true.
# TRUSTED_PROXIES=10.0.0.0/8
# REST API v2 authentication admission (defaults shown). Unidentified clients (no trusted proxy)
# share a bounded verification lane; an address over its failed-auth budget keeps a small
# per-IP allowance; recently verified credentials use a priority lane; legacy scrypt work is capped.
# API_V2_UNIDENTIFIED_AUTH_CONCURRENCY=16
# API_V2_OVER_BUDGET_IP_CONCURRENCY=4
# API_V2_PRIORITY_AUTH_CONCURRENCY=64
# API_V2_LEGACY_SCRYPT_CONCURRENCY=2
# API_V2_LEGACY_UNIDENTIFIED_LIMIT=30
# Comma-separated exact hostnames only; ports are not part of alias matching.
APP_HOST_ALIASES=
REDIRECT_TO_CANONICAL_HOST=true
# Legacy persistent setup credential. Prefer `node scripts/create-bootstrap-code.mjs`.
SETUP_SECRET=
# Generate with: openssl rand -base64 32
NEXTAUTH_SECRET=changeme_to_a_secure_random_string
# Generate independently with: openssl rand -base64 32
API_KEY_SECRET=changeme_to_a_different_secure_random_string
# Development/evaluation escape hatch only. Never enable in production.
ALLOW_INSECURE_SECRETS=false
# ----------------------------------------------
# 3. ENCRYPTION (REQUIRED IN PRODUCTION)
# ----------------------------------------------
# Generate with: openssl rand -hex 32
# Legacy single-key installs use runtime key ID k1. Keep this stable and backed up;
# losing it means re-entering encrypted secrets.
ENCRYPTION_KEY=
# Rotation form (preferred when changing keys): first key encrypts, all keys decrypt.
# ENCRYPTION_KEYS=k2:NEW_64_HEX_KEY,k1:PREVIOUS_64_HEX_KEY
# ----------------------------------------------
# 4. DOCKER COMPOSE SETTINGS
# ----------------------------------------------
POSTGRES_USER=opsknight
POSTGRES_PASSWORD=devpassword
POSTGRES_DB=opsknight_db
POSTGRES_PORT=5432
APP_PORT=3000
# ----------------------------------------------
# 5. ENTERPRISE AUTHENTICATION POLICY
# ----------------------------------------------
# Disable normal local email/password login while keeping OIDC available.
AUTH_LOCAL_LOGIN_ENABLED=true
# Optional emergency local access when normal local login is disabled.
AUTH_BREAK_GLASS_ENABLED=false
# AUTH_BREAK_GLASS_EMAIL=admin@example.com
# OIDC session controls. Values are seconds and are bounded by the runtime.
AUTH_SSO_SESSION_MAX_AGE_SECONDS=43200
AUTH_SSO_SESSION_UPDATE_AGE_SECONDS=3600
AUTH_SSO_SESSION_IDLE_TIMEOUT_SECONDS=14400
AUTH_SSO_REAUTH_AFTER_SECONDS=43200
# Optional strict generic OIDC email-verification policy.
# Validated Microsoft Entra issuers use provider-aware handling for a missing
# standard email_verified claim; explicit email_verified=false is rejected.
OIDC_REQUIRE_EMAIL_VERIFIED_STRICT=true
# SCIM 2.0 Users API bearer secret. Generate a high-entropy value, for example:
# openssl rand -hex 32
# SCIM_BEARER_TOKEN=
# Override only with a tested OpsKnight image tag or digest.
# OPSKNIGHT_IMAGE=ghcr.io/opsknight-labs/opsknight:<version>
# ----------------------------------------------
# 6. SLACK (OPTIONAL DEVELOPMENT OVERRIDE)
# ----------------------------------------------
# Slack is normally configured in the UI under Settings > Integrations > Slack.
# SLACK_SIGNING_SECRET=
# ----------------------------------------------
# 7. MONITORING & METRICS (OPTIONAL)
# ----------------------------------------------
# PROMETHEUS_SCRAPE_TOKEN=
# Manage service automation enablement and trace retention in Settings > System > Automation.