f7882241c7
OBS-001A: an authenticated /metrics so something other than a human reading logs can watch the box. no new dep — emits prometheus text straight from the counters we already keep: - /metrics behind a dedicated bearer token (sha-256 hash stored, plaintext only from REDFLAG_METRICS_TOKEN for bootstrap). constant-time compare, rotates without a restart, disabled by default, never an open route - exports db pool, taskrunner snapshot, scheduler + queue, breaker state, and the deferred-advisory count — read live on each scrape, bounded labels only - settings + migration 054 for observability.metrics_enabled / _token_hash also fixed migration 046 — it added a column and an index without IF NOT EXISTS and backfilled off a column it then drops, so it couldn't survive a second run. guarded every step; the idempotency lint is green again. only the migrations the runner hasn't recorded see the change, so live dbs don't care. builds clean, vet quiet, new tests pass.
37 lines
1.2 KiB
Shell
37 lines
1.2 KiB
Shell
# RedFlag Bootstrap Configuration
|
|
# Copy this to ./config/.env and edit the values below
|
|
|
|
# PostgreSQL Configuration
|
|
POSTGRES_DB=redflag
|
|
POSTGRES_USER=redflag
|
|
POSTGRES_PASSWORD=redflag_bootstrap
|
|
|
|
# RedFlag Server Configuration
|
|
REDFLAG_SERVER_HOST=0.0.0.0
|
|
REDFLAG_SERVER_PORT=8080
|
|
REDFLAG_DB_HOST=postgres
|
|
REDFLAG_DB_PORT=5432
|
|
REDFLAG_DB_NAME=redflag
|
|
REDFLAG_DB_USER=redflag
|
|
REDFLAG_DB_PASSWORD=redflag_bootstrap
|
|
|
|
# Admin Configuration
|
|
REDFLAG_ADMIN_USER=admin
|
|
REDFLAG_ADMIN_PASSWORD=CHANGE_ME_ADMIN_PASSWORD
|
|
REDFLAG_JWT_SECRET=CHANGE_ME_JWT_SECRET_AT_LEAST_32_CHARS_LONG
|
|
|
|
# Token Configuration
|
|
REDFLAG_TOKEN_EXPIRY=24h
|
|
REDFLAG_MAX_TOKENS=100
|
|
REDFLAG_MAX_SEATS=10
|
|
|
|
# CORS Configuration (F-A3-14)
|
|
# Set to your dashboard URL in production (default: http://localhost:3000)
|
|
# REDFLAG_CORS_ORIGIN=https://your-dashboard-domain.com
|
|
|
|
# Observability Configuration (OBS-001A)
|
|
# Enable the authenticated Prometheus /metrics endpoint and set a dedicated
|
|
# scrape token. Future UI rotation stores only the SHA-256 hash in
|
|
# observability.metrics_token_hash; this plaintext env value is bootstrap-only.
|
|
# REDFLAG_OBSERVABILITY_METRICS_ENABLED=true
|
|
# REDFLAG_METRICS_TOKEN=CHANGE_ME_METRICS_TOKEN_AT_LEAST_32_CHARS_LONG
|