DenozordecandCursor
0e9349e508
Docker images / prepare-release (push) Successful in 5s
Docker images / backend-image (push) Successful in 2m52s
Docker images / frontend-image (push) Successful in 2m23s
Docker images / notify-webhook (push) Skipped
Docker images / updater-image (push) Successful in 38s
Docker images / publish-release (push) Successful in 8s
JWT на backend, handoff/callback на UI, RBAC mm:*, AUTH_* в compose. Co-authored-by: Cursor <cursoragent@cursor.com>
53 lines
1.5 KiB
Plaintext
53 lines
1.5 KiB
Plaintext
# Production .env for deploy/docker-compose.cdn-mm.yml
|
|
# (CDN Manager + MikrotikManager + one Traefik).
|
|
# Copy to /opt/cdn-mm/.env and fill secrets. Do not commit.
|
|
|
|
# --- Traefik / Let's Encrypt (Cloudflare DNS-01) ---
|
|
# Token for ACME only (Zone DNS Edit). Separate from CLOUDFLARE_API_TOKEN below.
|
|
CF_DNS_API_TOKEN=
|
|
LETSENCRYPT_EMAIL=admin@shnt.top
|
|
# TRAEFIK_IMAGE_TAG=v3.7
|
|
# TRAEFIK_HTTP_PORT=80
|
|
# TRAEFIK_HTTPS_PORT=443
|
|
# TRAEFIK_LOG_LEVEL=INFO
|
|
|
|
# --- Public hosts ---
|
|
CDN_DOMAIN=cdn.shnt.top
|
|
MM_DOMAIN=mm.shnt.top
|
|
# Must match MM UI origin (https:// + MM_DOMAIN).
|
|
CORS_ORIGIN=https://mm.shnt.top
|
|
|
|
# --- Images ---
|
|
CDN_IMAGE_TAG=latest
|
|
# drop-in alias (same manifest): git.shx.one/denozord/cdn-manager
|
|
MM_BACKEND_IMAGE_TAG=latest
|
|
MM_FRONTEND_IMAGE_TAG=latest
|
|
MM_UPDATER_IMAGE_TAG=latest
|
|
|
|
# --- CDN Manager ---
|
|
CLOUDFLARE_API_TOKEN=
|
|
LOG_LEVEL=info
|
|
NODE_ENV=production
|
|
|
|
# Portal SSO — used by CDN Manager and MikrotikManager backend
|
|
AUTH_REQUIRED=true
|
|
# Same HS256 secret as auth-portal JWT_SECRET (required)
|
|
AUTH_JWT_SECRET=
|
|
# Optional alias — CDN Manager also reads JWT_SECRET
|
|
JWT_SECRET=
|
|
AUTH_ISSUER=https://auth.shnt.top
|
|
AUTH_PORTAL_URL=https://auth.shnt.top
|
|
# Shared with auth-portal AUDIT_INGEST_SECRET (optional, CDN Manager)
|
|
AUTH_AUDIT_INGEST_SECRET=
|
|
|
|
# Legacy local admin (CDN) — only when AUTH_REQUIRED=false
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD_HASH=
|
|
|
|
# --- MikrotikManager updater (optional; private registry pull) ---
|
|
REGISTRY_USERNAME=
|
|
REGISTRY_PASSWORD=
|
|
# POLL_INTERVAL_SECONDS=300
|
|
# HEALTH_TIMEOUT_SECONDS=120
|
|
# STOP_TIMEOUT_SECONDS=30
|