mirror of
https://github.com/suitenumerique/messages.git
synced 2026-10-01 06:04:57 +02:00
jbpenrath
7431850cd2
Capacitor apps must run the OIDC flow in the system browser (the IdP cookie has to live there to provide cross-app SSO), but the browser's cookies never reach the app's native HTTP layer, so the Django session created by the callback would be stranded. The callback now redirects to an allowlisted app deep link with a one-time token that the app exchanges for its session cookie and CSRF token. The token is bound to the initiating app instance with a PKCE S256 verifier, single-use, short-lived (MOBILE_AUTH_TOKEN_TTL) and the anonymous exchange endpoint is throttled per IP to cap brute-force guessing. An empty MOBILE_AUTH_CALLBACK_SCHEMES (the default) keeps the whole handoff disabled.
126 lines
4.0 KiB
Plaintext
126 lines
4.0 KiB
Plaintext
# App database configuration
|
|
DB_HOST=postgresql
|
|
DB_NAME=messages
|
|
DB_USER=user
|
|
DB_PASSWORD=pass
|
|
DB_PORT=5432
|
|
|
|
# Django
|
|
DJANGO_ALLOWED_HOSTS=*
|
|
DJANGO_SECRET_KEY=ThisIsAnExampleKeyForDevPurposeOnly
|
|
DJANGO_SETTINGS_MODULE=messages.settings
|
|
DJANGO_SUPERUSER_PASSWORD=admin
|
|
|
|
# Logging
|
|
# Set to DEBUG level for dev only
|
|
LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
|
|
LOGGING_LEVEL_LOGGERS_ROOT=INFO
|
|
LOGGING_LEVEL_LOGGERS_APP=INFO
|
|
|
|
# Prometheus
|
|
ENABLE_PROMETHEUS=0
|
|
PROMETHEUS_API_KEY=ExamplePrometheusApiKey
|
|
|
|
# Python
|
|
PYTHONPATH=/app
|
|
|
|
# Messages settings
|
|
|
|
# Mail
|
|
DJANGO_EMAIL_BRAND_NAME="La Suite territoriale"
|
|
DJANGO_EMAIL_HOST="mailcatcher"
|
|
DJANGO_EMAIL_LOGO_IMG="http://localhost:8900/assets/logo-suite-numerique.png"
|
|
DJANGO_EMAIL_PORT=1025
|
|
|
|
# Media
|
|
STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
|
|
AWS_S3_ENDPOINT_URL=http://objectstorage:9000
|
|
AWS_S3_ACCESS_KEY_ID=messages
|
|
AWS_S3_SECRET_ACCESS_KEY=password
|
|
AWS_S3_SIGNATURE_VERSION=s3v4
|
|
AWS_S3_DOMAIN_REPLACE=http://localhost:8906
|
|
|
|
# Message imports storage
|
|
STORAGE_MESSAGE_IMPORTS_ENDPOINT_URL=http://objectstorage:9000
|
|
STORAGE_MESSAGE_IMPORTS_BUCKET_NAME=msg-imports
|
|
STORAGE_MESSAGE_IMPORTS_ACCESS_KEY=st-messages
|
|
STORAGE_MESSAGE_IMPORTS_SECRET_KEY=password
|
|
STORAGE_MESSAGE_IMPORTS_EXPIRE_POLICY=600
|
|
|
|
# Object storage for tiered blob storage — points at the local
|
|
# objectstorage container; offload itself stays off by default
|
|
# (MESSAGES_BLOBS_OFFLOAD_ENABLED defaults to False in settings.py).
|
|
STORAGE_MESSAGE_BLOBS_ENDPOINT_URL=http://objectstorage:9000
|
|
STORAGE_MESSAGE_BLOBS_BUCKET_NAME=msg-blobs
|
|
STORAGE_MESSAGE_BLOBS_ACCESS_KEY=st-messages
|
|
STORAGE_MESSAGE_BLOBS_SECRET_KEY=password
|
|
|
|
# OIDC
|
|
OIDC_OP_JWKS_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/certs
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8902/realms/messages/protocol/openid-connect/auth
|
|
OIDC_OP_TOKEN_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/token
|
|
OIDC_OP_USER_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/userinfo
|
|
OIDC_OP_LOGOUT_ENDPOINT=http://localhost:8902/realms/messages/protocol/openid-connect/logout
|
|
|
|
OIDC_RP_CLIENT_ID=messages
|
|
OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
|
|
OIDC_RP_SIGN_ALGO=RS256
|
|
OIDC_RP_SCOPES="openid email"
|
|
|
|
LOGIN_REDIRECT_URL=http://localhost:8900
|
|
LOGIN_REDIRECT_URL_FAILURE=http://localhost:8900
|
|
LOGOUT_REDIRECT_URL=http://localhost:8900
|
|
|
|
OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8902", "http://localhost:8900"]
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
|
|
|
|
# Mobile apps (Capacitor) session handoff
|
|
MOBILE_AUTH_CALLBACK_SCHEMES=["stmessages"]
|
|
|
|
# keycloak
|
|
IDENTITY_PROVIDER=keycloak
|
|
KEYCLOAK_REALM=messages
|
|
KEYCLOAK_URL=http://keycloak:8802
|
|
KEYCLOAK_CLIENT_ID=rest-api
|
|
KEYCLOAK_CLIENT_SECRET=ServiceAccountClientSecretForDev
|
|
KEYCLOAK_GROUP_PATH_PREFIX=/maildomain-
|
|
|
|
# Frontend
|
|
# FRONTEND_THEME_CONFIG={"theme": "white-label"}
|
|
# FRONTEND_FORCED_DEFAULT_LANGUAGE=false
|
|
# FRONTEND_MULTIPART_UPLOAD_CHUNK_SIZE_MB=100
|
|
# FRONTEND_HELP_CENTER_URL=https://help.example.com
|
|
# FRONTEND_FEEDBACK_WIDGET_CONFIG={"api_url": "", "path": "", "channel": "", "home_channel": ""}
|
|
# FRONTEND_LAGAUFRE_WIDGET_CONFIG={"api_url": "", "path": ""}
|
|
|
|
# Messages
|
|
MESSAGES_TESTDOMAIN=example.local
|
|
MESSAGES_TESTDOMAIN_MAPPING_BASEDOMAIN=example.com
|
|
MTA_OUT_MODE=relay
|
|
MTA_OUT_RELAY_HOST=mailcatcher:1025
|
|
MDA_API_SECRET=my-shared-secret-mda
|
|
SALT_KEY=ThisIsAnExampleSaltForDevPurposeOnly
|
|
|
|
# Rspamd spam-check — disabled by default. The `mpa` service is not started by
|
|
# `make start`, and a configured-but-unreachable rspamd holds inbound mail for
|
|
# retry (fail-closed), which would stall the local pipeline. To enable spam
|
|
# checks locally, start `mpa` and uncomment the line below.
|
|
SPAM_CONFIG={}
|
|
# SPAM_CONFIG={"rspamd_url": "http://mpa:8010/_api", "rspamd_auth": ""}
|
|
|
|
# AI
|
|
AI_BASE_URL=
|
|
AI_API_KEY=
|
|
AI_MODEL=
|
|
|
|
# AI features
|
|
FEATURE_AI_SUMMARY=False
|
|
FEATURE_AI_AUTOLABELS=False
|
|
|
|
# Integrations enabled in the integrations modal (mailbox admins)
|
|
FEATURE_MAILBOX_ADMIN_CHANNELS=api_key,widget,webhook
|
|
|
|
# Third-party services
|
|
# Drive - https://github.com/suitenumerique/drive
|
|
DRIVE_BASE_URL=
|