Hide_D
663e66b8f9
VAPID private key를 Compose secret으로 주입하고 Web Push를 기본 비활성으로 전달한다. 활성화 입력과 Compose 모델 검증, 운영 README를 함께 추가한다.
109 lines
4.2 KiB
Bash
109 lines
4.2 KiB
Bash
# Public endpoint assigned to this stack. Caddy obtains TLS certificates for
|
|
# DOMAIN automatically when it terminates TLS itself.
|
|
DOMAIN=game.example.com
|
|
PUBLIC_SCHEME=https
|
|
ACME_EMAIL=admin@example.com
|
|
# Set http://DOMAIN when an external reverse proxy terminates TLS.
|
|
CADDY_SITE_ADDRESS=
|
|
HTTP_PORT=80
|
|
HTTPS_PORT=443
|
|
|
|
# Current local E2E ingress example (do not use dev-sam2026.hided.net here):
|
|
# DOMAIN=dev-sam-e2e.hided.net
|
|
# PUBLIC_SCHEME=https
|
|
# CADDY_SITE_ADDRESS=http://dev-sam-e2e.hided.net
|
|
# HTTP_PORT=14999
|
|
# HTTPS_PORT=15099
|
|
|
|
# Runtime hard limits. Keep swap equal to memory so the container cannot consume host swap.
|
|
RUNTIME_MEMORY_LIMIT=4g
|
|
RUNTIME_MEMORY_SWAP_LIMIT=4g
|
|
RUNTIME_CPU_LIMIT=4
|
|
RUNTIME_PIDS_LIMIT=512
|
|
# Runtime Node limits apply to APIs, daemons, and workers.
|
|
RUNTIME_NODE_OPTIONS=--max-old-space-size=1536
|
|
# Optional turn-daemon-only heap. Raise the runtime memory hard limit first.
|
|
TURN_DAEMON_NODE_OPTIONS=--max-old-space-size=1536
|
|
RUNTIME_RAYON_NUM_THREADS=1
|
|
|
|
# Isolated release builder. It has no DB, Redis, game-token, OAuth, or Docker
|
|
# socket credentials and serializes validated jobs on the private network.
|
|
BUILDER_MEMORY_LIMIT=4g
|
|
BUILDER_MEMORY_SWAP_LIMIT=4g
|
|
BUILDER_CPU_LIMIT=4
|
|
BUILDER_PIDS_LIMIT=256
|
|
BUILDER_NODE_OPTIONS=--max-old-space-size=3072
|
|
PROFILE_FRONTEND_BUILD_NODE_OPTIONS=--max-old-space-size=3072
|
|
BUILDER_RAYON_NUM_THREADS=2
|
|
RELEASE_TURBO_CONCURRENCY=1
|
|
# Optional smoke-only limits used with compose.smoke.yaml (maximum supported defaults shown).
|
|
# SMOKE_RUNTIME_MEMORY_LIMIT=4g
|
|
# SMOKE_RUNTIME_MEMORY_SWAP_LIMIT=4g
|
|
# SMOKE_RUNTIME_CPU_LIMIT=4
|
|
# SMOKE_RUNTIME_PIDS_LIMIT=256
|
|
|
|
# Core2026 source. A public HTTPS URL needs no extra credential.
|
|
CORE_REPOSITORY_URL=https://github.com/your-org/core2026.git
|
|
CORE_BOOTSTRAP_REF=main
|
|
|
|
# Optional private repository authentication. Keep only one mode enabled.
|
|
# HTTPS mode uses a read-only token through GIT_ASKPASS and never embeds it in the URL.
|
|
CORE_REPOSITORY_USERNAME=
|
|
CORE_REPOSITORY_TOKEN=
|
|
# SSH mode accepts base64-encoded deploy key and known_hosts contents.
|
|
CORE_SSH_PRIVATE_KEY_BASE64=
|
|
CORE_SSH_KNOWN_HOSTS_BASE64=
|
|
|
|
# Development bind override (used only with compose.dev.yaml).
|
|
# CORE_DEV_PATH=../core2026
|
|
# DEV_UID=1000
|
|
# DEV_GID=1000
|
|
# DEV_RUNTIME_MEMORY_LIMIT=4g
|
|
# DEV_RUNTIME_MEMORY_SWAP_LIMIT=4g
|
|
# DEV_RUNTIME_CPU_LIMIT=4
|
|
# DEV_RUNTIME_PIDS_LIMIT=256
|
|
|
|
# Persistent services. Use long random values; do not commit .env.
|
|
POSTGRES_DB=sammo
|
|
POSTGRES_USER=sammo
|
|
POSTGRES_PASSWORD=replace-with-a-long-random-database-password
|
|
REDIS_PASSWORD=replace-with-a-long-random-redis-password
|
|
GAME_TOKEN_SECRET=replace-with-at-least-32-random-bytes
|
|
GATEWAY_BOOTSTRAP_TOKEN=replace-with-a-separate-random-bootstrap-token
|
|
|
|
# The first startup creates this superuser only when the user table is empty.
|
|
INITIAL_ADMIN_USERNAME=admin
|
|
INITIAL_ADMIN_PASSWORD=replace-with-a-long-random-admin-password
|
|
INITIAL_ADMIN_DISPLAY_NAME=Administrator
|
|
|
|
# Kakao Developers app values. Register https://DOMAIN/gateway/oauth/callback.
|
|
KAKAO_REST_KEY=replace-with-kakao-rest-api-key
|
|
KAKAO_ADMIN_KEY=
|
|
|
|
# Account policy and optional compatibility secret.
|
|
GATEWAY_LOCAL_REGISTRATION_ENABLED=true
|
|
GATEWAY_ADMIN_LOCAL_ACCOUNT_ENABLED=true
|
|
GATEWAY_LOCAL_ACCOUNT_GRACE_DAYS=7
|
|
GATEWAY_LEGACY_PASSWORD_GLOBAL_SALT=
|
|
|
|
# Web Push is intentionally off until a VAPID key pair and contact subject are
|
|
# configured. The private key file is mounted as a Compose secret and must not
|
|
# be committed. The public key is safe to expose to browsers.
|
|
WEB_PUSH_ENABLED=false
|
|
WEB_PUSH_VAPID_SUBJECT=mailto:admin@example.com
|
|
WEB_PUSH_VAPID_PUBLIC_KEY=
|
|
WEB_PUSH_VAPID_PRIVATE_KEY_FILE=./secrets/web_push_vapid_private_key.example
|
|
WEB_PUSH_POLL_INTERVAL_MS=1000
|
|
WEB_PUSH_OUTBOX_POLL_MS=1000
|
|
|
|
# Shared image service. The two secret files must contain the values configured
|
|
# for the core2026 caller on the image server and must not be committed.
|
|
IMAGE_SERVICE_URL=https://sam-image.hided.net
|
|
IMAGE_PUBLIC_URL=https://sam-image.hided.net
|
|
IMAGE_UPLOAD_CORE2026_SECRET_FILE=./secrets/image_upload_core2026_secret
|
|
IMAGE_SYNC_CORE2026_SECRET_FILE=./secrets/image_sync_core2026_secret
|
|
|
|
# Initial stopped profile inventory. Each deployment can choose its own branch in the Admin GUI.
|
|
BOOTSTRAP_PROFILES=gateway,che,kwe,pwe,twe,nya,pya,hwe
|
|
TZ=Asia/Seoul
|