67e26be2d9
The public tree and its history contain only the listed paths. Earlier projection history remains preserved internally. Source-Sha: 913fde029b935671833254797f0f20f1eb9fabba Policy-Sha: 913fde029b935671833254797f0f20f1eb9fabba Tree-Digest: 180ae530c1058a2a5c89837bdce2d323ae83e669e38590ca72e75b8d92b7262f
70 lines
2.4 KiB
Shell
70 lines
2.4 KiB
Shell
# ============================================================
|
|
# RedFlag Configuration
|
|
# Copy this file to: config/.env
|
|
# Then run: docker-compose up -d
|
|
# ============================================================
|
|
|
|
# --- PostgreSQL ---
|
|
POSTGRES_DB=redflag
|
|
POSTGRES_USER=redflag
|
|
POSTGRES_PASSWORD=CHANGE_ME_pick_a_strong_db_password
|
|
|
|
# --- Server ---
|
|
REDFLAG_SERVER_HOST=0.0.0.0
|
|
REDFLAG_SERVER_PORT=8080
|
|
REDFLAG_DB_HOST=postgres
|
|
REDFLAG_DB_PORT=5432
|
|
REDFLAG_DB_NAME=redflag
|
|
REDFLAG_DB_USER=redflag
|
|
REDFLAG_DB_PASSWORD=CHANGE_ME_pick_a_strong_db_password
|
|
|
|
# --- Admin Account ---
|
|
# After first-run setup these are persisted in the database;
|
|
# the .env values re-apply on restart.
|
|
REDFLAG_ADMIN_USER=admin
|
|
REDFLAG_ADMIN_EMAIL=admin@example.com
|
|
REDFLAG_ADMIN_PASSWORD=CHANGE_ME_pick_a_strong_admin_password
|
|
REDFLAG_JWT_SECRET=CHANGE_ME_random_string_at_least_32_characters_long
|
|
|
|
# --- Agent Registration ---
|
|
REDFLAG_TOKEN_EXPIRY=24h
|
|
REDFLAG_MAX_TOKENS=100
|
|
REDFLAG_MAX_SEATS=50
|
|
|
|
# --- Ed25519 Signing Key ---
|
|
# Leave blank on first run. Go to http://localhost:31337/setup
|
|
# and click "Generate Keys". Copy the private key here, then
|
|
# restart the server. Without this, agents cannot receive
|
|
# signed commands or upgrade themselves.
|
|
# BACKUP THE PRIVATE KEY. Losing it means re-enrolling every agent.
|
|
REDFLAG_SIGNING_PRIVATE_KEY=
|
|
|
|
# --- Public URL (optional) ---
|
|
# Set this if you're behind a reverse proxy or using a domain.
|
|
# Agents use this URL to connect. If unset, the server uses
|
|
# its own hostname.
|
|
# REDFLAG_PUBLIC_URL=https://redflag.example.com
|
|
|
|
# --- Binary Storage ---
|
|
# Where signed agent binaries are stored on disk.
|
|
# Default is fine for Docker deployments.
|
|
REDFLAG_BINARY_STORAGE_PATH=./binaries
|
|
|
|
# --- TLS (optional) ---
|
|
# REDFLAG_TLS_ENABLED=false
|
|
# REDFLAG_TLS_CERT_FILE=/path/to/cert.pem
|
|
# REDFLAG_TLS_KEY_FILE=/path/to/key.pem
|
|
|
|
# --- CORS (F-A3-14) ---
|
|
# Set to your dashboard URL in production (default: http://localhost:3000)
|
|
# REDFLAG_CORS_ORIGIN=https://your-dashboard-domain.com
|
|
|
|
# --- Observability (OBS-001A) ---
|
|
# Enable the authenticated Prometheus /metrics endpoint and set a dedicated
|
|
# scrape token. Future UI rotation stores only the SHA-256 hash in
|
|
# observability.metrics_token_hash; this plaintext env value is bootstrap-only.
|
|
# REDFLAG_OBSERVABILITY_METRICS_ENABLED=true
|
|
# REDFLAG_METRICS_TOKEN=CHANGE_ME_METRICS_TOKEN_AT_LEAST_32_CHARS_LONG
|
|
|
|
# --- Debug (disable in production) ---
|
|
REDFLAG_DEBUG=false
|