mirror of
https://github.com/suitenumerique/messages.git
synced 2026-08-17 21:25:41 +02:00
jbpenrath
94d079bc1b
Store review cycles make shipping web-layer fixes through the stores too slow, so the apps update their JS bundle over the air. The chain is fully self-hosted to keep sovereignty: bundles and channel manifests live on an anonymous-read S3 bucket (create_bucket --public / the create-ota-bucket script) and the Capgo plugin is driven entirely from JS against that manifest (autoUpdate off — no Capgo server involved). Bundles are RSA-signed at publish time and verified against the per-instance public key baked in at cap sync, so a tampered zip on the public bucket is rejected. Versions use a git-derived <count>-<sha> id stamped into the builtin bundle so a fresh install does not re-download its own commit, and channels (dev/staging/prod) are fully independent because NEXT_PUBLIC_* vars are inlined at build time. Also ships docs/mobile.md.
132 lines
4.4 KiB
Plaintext
132 lines
4.4 KiB
Plaintext
# App database configuration
|
|
DB_HOST=postgresql
|
|
DB_NAME=messages
|
|
DB_USER=user
|
|
DB_PASSWORD=pass
|
|
DB_PORT=5432
|
|
|
|
# Django
|
|
DJANGO_ALLOWED_HOSTS=*
|
|
DJANGO_SECRET_KEY=ThisIsAnExampleKeyForDevPurposeOnly
|
|
DJANGO_SETTINGS_MODULE=messages.settings
|
|
DJANGO_SUPERUSER_PASSWORD=admin
|
|
|
|
# Logging
|
|
# Set to DEBUG level for dev only
|
|
LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
|
|
LOGGING_LEVEL_LOGGERS_ROOT=INFO
|
|
LOGGING_LEVEL_LOGGERS_APP=INFO
|
|
|
|
# Prometheus
|
|
ENABLE_PROMETHEUS=0
|
|
PROMETHEUS_API_KEY=ExamplePrometheusApiKey
|
|
|
|
# Python
|
|
PYTHONPATH=/app
|
|
|
|
# Messages settings
|
|
|
|
# Mail
|
|
DJANGO_EMAIL_BRAND_NAME="La Suite territoriale"
|
|
DJANGO_EMAIL_HOST="mailcatcher"
|
|
DJANGO_EMAIL_LOGO_IMG="http://localhost:8900/assets/logo-suite-numerique.png"
|
|
DJANGO_EMAIL_PORT=1025
|
|
|
|
# Media
|
|
STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
|
|
AWS_S3_ENDPOINT_URL=http://objectstorage:9000
|
|
AWS_S3_ACCESS_KEY_ID=messages
|
|
AWS_S3_SECRET_ACCESS_KEY=password
|
|
AWS_S3_SIGNATURE_VERSION=s3v4
|
|
AWS_S3_DOMAIN_REPLACE=http://localhost:8906
|
|
|
|
# Message imports storage
|
|
STORAGE_MESSAGE_IMPORTS_ENDPOINT_URL=http://objectstorage:9000
|
|
STORAGE_MESSAGE_IMPORTS_BUCKET_NAME=msg-imports
|
|
STORAGE_MESSAGE_IMPORTS_ACCESS_KEY=st-messages
|
|
STORAGE_MESSAGE_IMPORTS_SECRET_KEY=password
|
|
STORAGE_MESSAGE_IMPORTS_EXPIRE_POLICY=600
|
|
|
|
# Object storage for tiered blob storage — points at the local
|
|
# objectstorage container; offload itself stays off by default
|
|
# (MESSAGES_BLOBS_OFFLOAD_ENABLED defaults to False in settings.py).
|
|
STORAGE_MESSAGE_BLOBS_ENDPOINT_URL=http://objectstorage:9000
|
|
STORAGE_MESSAGE_BLOBS_BUCKET_NAME=msg-blobs
|
|
STORAGE_MESSAGE_BLOBS_ACCESS_KEY=st-messages
|
|
STORAGE_MESSAGE_BLOBS_SECRET_KEY=password
|
|
|
|
# OIDC
|
|
OIDC_OP_JWKS_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/certs
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8902/realms/messages/protocol/openid-connect/auth
|
|
OIDC_OP_TOKEN_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/token
|
|
OIDC_OP_USER_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/userinfo
|
|
OIDC_OP_LOGOUT_ENDPOINT=http://localhost:8902/realms/messages/protocol/openid-connect/logout
|
|
|
|
OIDC_RP_CLIENT_ID=messages
|
|
OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
|
|
OIDC_RP_SIGN_ALGO=RS256
|
|
OIDC_RP_SCOPES="openid email"
|
|
|
|
LOGIN_REDIRECT_URL=http://localhost:8900
|
|
LOGIN_REDIRECT_URL_FAILURE=http://localhost:8900
|
|
LOGOUT_REDIRECT_URL=http://localhost:8900
|
|
|
|
OIDC_REDIRECT_ALLOWED_HOSTS=["http://localhost:8902", "http://localhost:8900"]
|
|
OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}
|
|
|
|
# Mobile apps (Capacitor) session handoff
|
|
MOBILE_AUTH_CALLBACK_SCHEMES=["stmessages"]
|
|
|
|
# Mobile apps (Capacitor) OTA — OPT-IN in dev: channel manifest URL served to
|
|
# the apps through /config (see ota.ts). Uncomment (working dev-stack value,
|
|
# device-reachable via adb reverse) together with the publishing block in
|
|
# frontend.defaults to exercise the OTA chain.
|
|
# MOBILE_OTA_MANIFEST_URL=http://localhost:8906/messages-ota/channels/dev/manifest.json
|
|
|
|
# keycloak
|
|
IDENTITY_PROVIDER=keycloak
|
|
KEYCLOAK_REALM=messages
|
|
KEYCLOAK_URL=http://keycloak:8802
|
|
KEYCLOAK_CLIENT_ID=rest-api
|
|
KEYCLOAK_CLIENT_SECRET=ServiceAccountClientSecretForDev
|
|
KEYCLOAK_GROUP_PATH_PREFIX=/maildomain-
|
|
|
|
# Frontend
|
|
# FRONTEND_THEME_CONFIG={"theme": "white-label"}
|
|
# FRONTEND_FORCED_DEFAULT_LANGUAGE=false
|
|
# FRONTEND_MULTIPART_UPLOAD_CHUNK_SIZE_MB=100
|
|
# FRONTEND_HELP_CENTER_URL=https://help.example.com
|
|
# FRONTEND_FEEDBACK_WIDGET_CONFIG={"api_url": "", "path": "", "channel": "", "home_channel": ""}
|
|
# FRONTEND_LAGAUFRE_WIDGET_CONFIG={"api_url": "", "path": ""}
|
|
|
|
# Messages
|
|
MESSAGES_TESTDOMAIN=example.local
|
|
MESSAGES_TESTDOMAIN_MAPPING_BASEDOMAIN=example.com
|
|
MTA_OUT_MODE=relay
|
|
MTA_OUT_RELAY_HOST=mailcatcher:1025
|
|
MDA_API_SECRET=my-shared-secret-mda
|
|
SALT_KEY=ThisIsAnExampleSaltForDevPurposeOnly
|
|
|
|
# Rspamd spam-check — disabled by default. The `mpa` service is not started by
|
|
# `make start`, and a configured-but-unreachable rspamd holds inbound mail for
|
|
# retry (fail-closed), which would stall the local pipeline. To enable spam
|
|
# checks locally, start `mpa` and uncomment the line below.
|
|
SPAM_CONFIG={}
|
|
# SPAM_CONFIG={"rspamd_url": "http://mpa:8010/_api", "rspamd_auth": ""}
|
|
|
|
# AI
|
|
AI_BASE_URL=
|
|
AI_API_KEY=
|
|
AI_MODEL=
|
|
|
|
# AI features
|
|
FEATURE_AI_SUMMARY=False
|
|
FEATURE_AI_AUTOLABELS=False
|
|
|
|
# Integrations enabled in the integrations modal (mailbox admins)
|
|
FEATURE_MAILBOX_ADMIN_CHANNELS=api_key,widget,webhook
|
|
|
|
# Third-party services
|
|
# Drive - https://github.com/suitenumerique/drive
|
|
DRIVE_BASE_URL=
|