mirror of
https://github.com/suitenumerique/meet.git
synced 2026-08-17 21:15:43 +02:00
Arnaud Robinandaleb_the_flash
0c0b2f2616
Expose a room options Documentation link via FRONTEND_DOCUMENTATION_URL so deployers can set or hide it.
397 lines
12 KiB
Go Template
397 lines
12 KiB
Go Template
|
|
# -----------------------------------------------------------
|
|
# Security contexts (dev-only: run as root, no restrictions)
|
|
# -----------------------------------------------------------
|
|
|
|
.podSecurityContext: &podSecurityContext
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
fsGroup: 0
|
|
runAsNonRoot: false
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
.securityContext: &securityContext
|
|
allowPrivilegeEscalation: true
|
|
capabilities:
|
|
drop: []
|
|
|
|
# -----------------------------------------------------------
|
|
# Shared anchors
|
|
# -----------------------------------------------------------
|
|
|
|
_summaryEnvVars: &summaryEnvVars
|
|
APP_NAME: summary-microservice
|
|
APP_API_TOKEN: password
|
|
AWS_STORAGE_BUCKET_NAME: meet-media-storage
|
|
AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000/
|
|
AWS_S3_ACCESS_KEY_ID: meet
|
|
AWS_S3_SECRET_ACCESS_KEY: password
|
|
AWS_S3_SECURE_ACCESS: False
|
|
AUTHORIZED_TENANTS: >
|
|
[
|
|
{
|
|
"id": "dictaphone",
|
|
"api_key": "dictaphone_token",
|
|
"webhook_url": "http://dictaphone-backend.dictaphone.svc.cluster.local/api/v1.0/ai-jobs/webhook/",
|
|
"webhook_api_key": "token_summary",
|
|
"allowed_push_to_docs": false
|
|
},
|
|
{
|
|
"id": "meet",
|
|
"api_key": "password",
|
|
"webhook_url": "https://meet.127.0.0.1.nip.io/api/v1.0/recordings/external-process-hook/",
|
|
"webhook_api_key": "webhook-password",
|
|
"allowed_push_to_docs": false
|
|
}
|
|
]
|
|
SSL_CERT_FILE: /usr/local/lib/python3.13/site-packages/certifi/cacert.pem
|
|
IS_DOCS_INTEGRATION_ENABLED: false
|
|
WHISPERX_API_KEY:
|
|
secretKeyRef:
|
|
name: secret-dev
|
|
key: WHISPERX_API_KEY
|
|
WHISPERX_BASE_URL:
|
|
secretKeyRef:
|
|
name: secret-dev
|
|
key: WHISPERX_BASE_URL
|
|
WHISPERX_ASR_MODEL: openai/whisper-large-v3
|
|
WHISPERX_DEFAULT_LANGUAGE: fr
|
|
LLM_BASE_URL:
|
|
secretKeyRef:
|
|
name: secret-dev
|
|
key: LLM_BASE_URL
|
|
LLM_API_KEY:
|
|
secretKeyRef:
|
|
name: secret-dev
|
|
key: LLM_API_KEY
|
|
LLM_MODEL: Qwen/Qwen3-Coder-30B-A3B-Instruct
|
|
WEBHOOK_API_TOKEN: password
|
|
WEBHOOK_URL: https://www.mock-impress.com/webhook/
|
|
CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
|
|
CELERY_RESULT_BACKEND: redis://default:pass@redis-master:6379/1
|
|
TASK_TRACKER_REDIS_URL: redis://default:pass@redis-master:6379/1
|
|
IS_RESOLVE_SPEAKER_IDENTITIES_ENABLED: true
|
|
RESOLVE_SPEAKER_IDENTITIES_DEFAULT_OVERLAP: 0.5
|
|
RESOLVE_SPEAKER_ENABLE_SPLIT_ON_WORDS: true
|
|
RESOLVE_SPEAKER_MAX_WORD_DURATION: 1
|
|
POSTHOG_API_KEY: your-posthog-key
|
|
POSTHOG_ENABLED: False
|
|
|
|
_summaryImage: &summaryImage
|
|
repository: localhost:5001/meet-summary
|
|
pullPolicy: Always
|
|
tag: "latest"
|
|
|
|
# -----------------------------------------------------------
|
|
# Shared component definitions
|
|
# -----------------------------------------------------------
|
|
image:
|
|
repository: localhost:5001/meet-backend
|
|
pullPolicy: Always
|
|
tag: "latest"
|
|
|
|
backend:
|
|
replicas: 1
|
|
envVars:
|
|
DJANGO_CSRF_TRUSTED_ORIGINS: https://meet.127.0.0.1.nip.io,http://meet.127.0.0.1.nip.io
|
|
DJANGO_CONFIGURATION: Production
|
|
DJANGO_ALLOWED_HOSTS: meet.127.0.0.1.nip.io
|
|
DJANGO_SECRET_KEY: {{ .Values.djangoSecretKey }}
|
|
DJANGO_SETTINGS_MODULE: meet.settings
|
|
DJANGO_SILENCED_SYSTEM_CHECKS: security.W004, security.W008
|
|
DJANGO_SUPERUSER_PASSWORD: admin
|
|
# Email notification
|
|
DJANGO_EMAIL_HOST: "mailcatcher"
|
|
DJANGO_EMAIL_PORT: 1025
|
|
DJANGO_EMAIL_USE_SSL: False
|
|
DJANGO_EMAIL_BRAND_NAME: "La Suite Numérique"
|
|
DJANGO_EMAIL_SUPPORT_EMAIL: "test@yopmail.com"
|
|
DJANGO_EMAIL_LOGO_IMG: https://meet.127.0.0.1.nip.io/assets/logo-suite-numerique.png
|
|
DJANGO_EMAIL_DOMAIN: meet.127.0.0.1.nip.io
|
|
DJANGO_EMAIL_APP_BASE_URL: https://meet.127.0.0.1.nip.io
|
|
# OIDC & Auth
|
|
OIDC_OP_JWKS_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/certs
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/auth
|
|
OIDC_OP_TOKEN_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/token
|
|
OIDC_OP_USER_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/userinfo
|
|
OIDC_OP_LOGOUT_ENDPOINT: https://keycloak.127.0.0.1.nip.io/realms/meet/protocol/openid-connect/logout
|
|
OIDC_RP_CLIENT_ID: meet
|
|
OIDC_RP_CLIENT_SECRET: ThisIsAnExampleKeyForDevPurposeOnly
|
|
OIDC_RP_SIGN_ALGO: RS256
|
|
OIDC_RP_SCOPES: "openid email"
|
|
OIDC_REDIRECT_ALLOWED_HOSTS: https://meet.127.0.0.1.nip.io
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS: "{'acr_values': 'eidas1'}"
|
|
LOGIN_REDIRECT_URL: https://meet.127.0.0.1.nip.io
|
|
LOGIN_REDIRECT_URL_FAILURE: https://meet.127.0.0.1.nip.io
|
|
LOGOUT_REDIRECT_URL: https://meet.127.0.0.1.nip.io
|
|
# Databases
|
|
DB_HOST: postgres
|
|
DB_NAME: meet
|
|
DB_USER: dinum
|
|
DB_PASSWORD: pass
|
|
DB_PORT: 5432
|
|
REDIS_URL: redis://default:pass@redis-master:6379/1
|
|
# Static files
|
|
STORAGES_STATICFILES_BACKEND: django.contrib.staticfiles.storage.StaticFilesStorage
|
|
# Permissions
|
|
ALLOW_UNREGISTERED_ROOMS: False
|
|
# Certs for dev purpose only
|
|
SSL_CERT_FILE: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
|
|
# Livekit
|
|
{{- with .Values.livekit.keys }}
|
|
{{- range $key, $value := . }}
|
|
LIVEKIT_API_SECRET: {{ $value }}
|
|
LIVEKIT_API_KEY: {{ $key }}
|
|
{{- end }}
|
|
{{- end }}
|
|
LIVEKIT_API_URL: https://livekit.127.0.0.1.nip.io/
|
|
LIVEKIT_WEBHOOK_EVENTS_FILTER_REGEX: "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
|
|
# Frontend
|
|
LIVEKIT_FORCE_WSS_PROTOCOL: True
|
|
LIVEKIT_ENABLE_FIREFOX_PROXY_WORKAROUND: True
|
|
FRONTEND_IDLE_DISCONNECT_WARNING_DELAY: 9000
|
|
FRONTEND_SILENCE_LIVEKIT_DEBUG: False
|
|
FRONTEND_SUPPORT: "{'id': '58ea6697-8eba-4492-bc59-ad6562585041', 'help_article_transcript': 'https://lasuite.crisp.help/fr/article/visio-transcript-1sjq43x', 'help_article_recording': 'https://lasuite.crisp.help/fr/article/visio-enregistrement-wgc8o0', 'help_article_more_tools': 'https://lasuite.crisp.help/fr/article/visio-tools-bvxj23'}"
|
|
FRONTEND_FEEDBACK: "{'url': 'https://grist.numerique.gouv.fr/o/docs/cbMv4G7pLY3Z/USER-RESEARCH-or-LA-SUITE/f/26'}"
|
|
FRONTEND_DOCUMENTATION_URL: "https://docs.numerique.gouv.fr/docs/7c5bd65d-3c21-486f-bce1-26e0a921d642/"
|
|
FRONTEND_MANIFEST_LINK: "https://docs.numerique.gouv.fr/docs/1ef86abf-f7e0-46ce-b6c7-8be8b8af4c3d/"
|
|
FRONTEND_IDLE_DISCONNECT_WARNING_DELAY: 9000
|
|
FRONTEND_TRANSCRIPTION_DESTINATION: "https://docs.numerique.gouv.fr"
|
|
FRONTEND_IS_SILENT_LOGIN_ENABLED: False
|
|
# S3 Storage
|
|
AWS_S3_ENDPOINT_URL: http://minio.meet.svc.cluster.local:9000
|
|
AWS_S3_ACCESS_KEY_ID: meet
|
|
AWS_S3_SECRET_ACCESS_KEY: password
|
|
AWS_STORAGE_BUCKET_NAME: meet-media-storage
|
|
# Telephony
|
|
ROOM_TELEPHONY_ENABLED: True
|
|
ROOM_TELEPHONY_DEFAULT_COUNTRY: 'FR'
|
|
ROOM_TELEPHONY_PHONE_NUMBER: '+33901020304'
|
|
# Metadata Agent
|
|
METADATA_COLLECTOR_ENABLED: True
|
|
# External API
|
|
EXTERNAL_API_ENABLED: True
|
|
# Service Account
|
|
APPLICATION_JWT_AUDIENCE: https://meet.127.0.0.1.nip.io/external-api/v1.0/
|
|
APPLICATION_JWT_SECRET_KEY: devKeyApplication
|
|
APPLICATION_BASE_URL: https://meet.127.0.0.1.nip.io
|
|
# Custom Background
|
|
AWS_S3_REGION_NAME: local
|
|
AWS_S3_SIGNATURE_VERSION: s3v4
|
|
AWS_S3_DOMAIN_REPLACE: https://minio.127.0.0.1.nip.io
|
|
MEDIA_BASE_URL: https://meet.127.0.0.1.nip.io
|
|
FILE_UPLOAD_ENABLED: True
|
|
CELERY_ENABLED: True
|
|
CELERY_BROKER_URL: redis://default:pass@redis-master:6379/1
|
|
# Recording & Transcription
|
|
RECORDING_ENABLE: True
|
|
RECORDING_STORAGE_EVENT_ENABLE: True
|
|
RECORDING_STORAGE_EVENT_TOKEN: password
|
|
SUMMARY_SERVICE_ENDPOINT: http://meet-summary:80/api/v2/async-jobs/transcribe/
|
|
SUMMARY_SERVICE_API_TOKEN: password
|
|
SUMMARY_SERVICE_WEBHOOK_API_TOKEN: webhook-password
|
|
RECORDING_DOWNLOAD_BASE_URL: https://meet.127.0.0.1.nip.io/recording
|
|
OIDC_USERINFO_FULLNAME_FIELDS: first_name, last_name
|
|
OIDC_USERINFO_SHORTNAME_FIELD: first_name
|
|
|
|
migrate:
|
|
command:
|
|
- "/bin/sh"
|
|
- "-c"
|
|
- |
|
|
python manage.py migrate --no-input
|
|
restartPolicy: Never
|
|
|
|
command:
|
|
- "gunicorn"
|
|
- "-c"
|
|
- "/usr/local/etc/gunicorn/meet.py"
|
|
- "meet.wsgi:application"
|
|
- "--reload"
|
|
|
|
createsuperuser:
|
|
command:
|
|
- "/bin/sh"
|
|
- "-c"
|
|
- |
|
|
python manage.py createsuperuser --email admin@example.com --password admin
|
|
restartPolicy: Never
|
|
|
|
extraVolumeMounts:
|
|
- name: certs
|
|
mountPath: /app/.venv/lib/python3.13/site-packages/certifi/cacert.pem
|
|
subPath: cacert.pem
|
|
|
|
extraVolumes:
|
|
- name: certs
|
|
configMap:
|
|
name: certifi
|
|
items:
|
|
- key: cacert.pem
|
|
path: cacert.pem
|
|
|
|
podSecurityContext: *podSecurityContext
|
|
securityContext: *securityContext
|
|
|
|
frontend:
|
|
replicas: 1
|
|
podSecurityContext: *podSecurityContext
|
|
securityContext: *securityContext
|
|
|
|
ingress:
|
|
enabled: true
|
|
host: meet.127.0.0.1.nip.io
|
|
|
|
ingressAdmin:
|
|
enabled: true
|
|
host: meet.127.0.0.1.nip.io
|
|
|
|
ingressWebhook:
|
|
enabled: true
|
|
host: meet.127.0.0.1.nip.io
|
|
|
|
posthog:
|
|
ingress:
|
|
enabled: false
|
|
ingressAssets:
|
|
enabled: false
|
|
|
|
# ---- Extra ingress/service for recording file downloads -----------
|
|
|
|
ingressMedia:
|
|
enabled: true
|
|
host: meet.127.0.0.1.nip.io
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/recordings/media-auth/
|
|
nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
|
|
nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
|
|
nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/$1
|
|
|
|
serviceMedia:
|
|
host: minio.meet.svc.cluster.local
|
|
port: 9000
|
|
|
|
# ---- Extra ingress/service for background file uploads ------------
|
|
|
|
ingressMediaFiles:
|
|
enabled: true
|
|
host: meet.127.0.0.1.nip.io
|
|
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/auth-url: https://meet.127.0.0.1.nip.io/api/v1.0/files/media-auth/
|
|
nginx.ingress.kubernetes.io/auth-response-headers: "Authorization, X-Amz-Date, X-Amz-Content-SHA256"
|
|
nginx.ingress.kubernetes.io/upstream-vhost: minio.meet.svc.cluster.local:9000
|
|
nginx.ingress.kubernetes.io/rewrite-target: /meet-media-storage/files/$1
|
|
|
|
serviceMediaFiles:
|
|
host: minio.meet.svc.cluster.local
|
|
port: 9000
|
|
|
|
# ---- STT Orchestration Microservice Components --------------------
|
|
|
|
summary:
|
|
replicas: 1
|
|
image: *summaryImage
|
|
envVars:
|
|
<<: *summaryEnvVars
|
|
podSecurityContext: *podSecurityContext
|
|
securityContext: *securityContext
|
|
|
|
celeryTranscribe:
|
|
replicas: 1
|
|
image: *summaryImage
|
|
envVars:
|
|
<<: *summaryEnvVars
|
|
podSecurityContext: *podSecurityContext
|
|
securityContext: *securityContext
|
|
command:
|
|
- "celery"
|
|
- "-A"
|
|
- "summary.core.celery_worker"
|
|
- "worker"
|
|
- "--pool=solo"
|
|
- "--loglevel=info"
|
|
- "-Q"
|
|
- "transcribe-queue-v2"
|
|
|
|
celerySummarize:
|
|
replicas: 1
|
|
image: *summaryImage
|
|
envVars:
|
|
<<: *summaryEnvVars
|
|
podSecurityContext: *podSecurityContext
|
|
securityContext: *securityContext
|
|
command:
|
|
- "celery"
|
|
- "-A"
|
|
- "summary.core.celery_worker"
|
|
- "worker"
|
|
- "--pool=solo"
|
|
- "--loglevel=info"
|
|
- "-Q"
|
|
- "summarize-queue-v2"
|
|
|
|
celerySummaryBackend:
|
|
replicas: 1
|
|
image: *summaryImage
|
|
envVars:
|
|
<<: *summaryEnvVars
|
|
podSecurityContext: *podSecurityContext
|
|
securityContext: *securityContext
|
|
|
|
command:
|
|
- "celery"
|
|
- "-A"
|
|
- "summary.core.celery_worker"
|
|
- "worker"
|
|
- "--pool=solo"
|
|
- "--loglevel=info"
|
|
- "-Q"
|
|
- "call-webhook-queue-v2"
|
|
|
|
# ---- Livekit agents components ------------------------------------
|
|
|
|
agentMetadata:
|
|
replicas: 1
|
|
envVars:
|
|
LIVEKIT_URL: https://livekit.127.0.0.1.nip.io/
|
|
{{- with .Values.livekit.keys }}
|
|
{{- range $key, $value := . }}
|
|
LIVEKIT_API_SECRET: {{ $value }}
|
|
LIVEKIT_API_KEY: {{ $key }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ENABLE_SILERO_VAD: "false"
|
|
AWS_S3_ENDPOINT_URL: minio.meet.svc.cluster.local:9000
|
|
AWS_S3_ACCESS_KEY_ID: meet
|
|
AWS_S3_SECRET_ACCESS_KEY: password
|
|
AWS_S3_SECURE_ACCESS: False
|
|
AWS_STORAGE_BUCKET_NAME: meet-media-storage
|
|
AWS_S3_OUTPUT_FOLDER: metadata
|
|
|
|
image:
|
|
repository: localhost:5001/meet-agents
|
|
pullPolicy: Always
|
|
tag: "latest"
|
|
|
|
command:
|
|
- "python"
|
|
- "metadata_collector.py"
|
|
- "start"
|
|
|
|
# Extra volume mounts to manage our local custom CA and avoid to disable ssl
|
|
extraVolumeMounts:
|
|
- name: certs
|
|
mountPath: /usr/lib/ssl/cert.pem
|
|
subPath: cert.pem
|
|
|
|
# Extra volumes to manage our local custom CA and avoid to disable ssl
|
|
extraVolumes:
|
|
- name: certs
|
|
configMap:
|
|
name: certifi
|
|
items:
|
|
- key: cacert.pem
|
|
path: cert.pem
|