-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.compose.example
More file actions
130 lines (126 loc) · 5.81 KB
/
Copy path.env.compose.example
File metadata and controls
130 lines (126 loc) · 5.81 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# Copy to .env.compose and start with:
# docker compose --env-file .env.compose up -d
#
# Every published service binds to 127.0.0.1. Change ports here if the
# preflight script reports a collision.
COMPOSE_PROJECT_NAME=portage-engine
PORTAGE_SERVER_PORT=18080
PORTAGE_WORKER_GATEWAY_PORT=19444
# Set true after running:
# WORKER_GATEWAY_HOST=<LAN DNS name or IP> scripts/generate-worker-pki.sh .local/worker-pki
# For PVE builders, bind on the reachable LAN address (or 0.0.0.0) and use
# exactly the same host in the advertise URL/certificate SAN.
PORTAGE_WORKER_GATEWAY_ENABLED=false
PORTAGE_WORKER_GATEWAY_ISSUER_ID=compose-local
PORTAGE_WORKER_GATEWAY_ISSUER_PROVIDER=file
PORTAGE_WORKER_GATEWAY_BIND=127.0.0.1
PORTAGE_WORKER_GATEWAY_ADVERTISE_URL=
PORTAGE_WORKER_PKI_DIR=./.local/worker-pki
PORTAGE_WORKER_SECRETS_DIR=./.local/worker-secrets
PORTAGE_WORKER_CERTIFICATE_TTL_MINUTES=180
# External issuer example (`file` remains the local default):
# PORTAGE_WORKER_GATEWAY_ISSUER_PROVIDER=vault
# PORTAGE_WORKER_GATEWAY_VAULT_ADDRESS=https://vault.internal.example
# PORTAGE_WORKER_GATEWAY_VAULT_MOUNT=pki_workers
# PORTAGE_WORKER_GATEWAY_VAULT_ROLE=portage-worker
# PORTAGE_WORKER_GATEWAY_VAULT_TOKEN_FILE=/run/worker-secrets/vault-token
# PORTAGE_WORKER_GATEWAY_VAULT_SERVER_CA=/run/worker-secrets/vault-ca.crt
# PORTAGE_WORKER_GATEWAY_VAULT_NAMESPACE=
# PORTAGE_WORKER_GATEWAY_VAULT_TIMEOUT_SECONDS=15
# Keep shadow for normal upgrades. Set active only after both control-plane
# replicas run schema-v22/protocol-5 binaries and the worker gateway is enabled.
PORTAGE_PHASE_EXECUTOR_MODE=shadow
# Empty capability labels are derived from the reviewed catalog for the
# configured provider and zones. Set an explicit list only for a specialized
# executor (for example a desktop verifier) and include every exact label it
# may claim. The HA overlay supports an independent secondary override.
PORTAGE_EXECUTOR_ZONES=default
PORTAGE_EXECUTOR_CAPABILITIES=
PORTAGE_EXECUTOR_ZONES_SECONDARY=default
PORTAGE_EXECUTOR_CAPABILITIES_SECONDARY=
# Observe-only shared recommendation. It does not call PVE or another cloud
# provider; a future capability-pool actuator consumes the desired slot count.
PORTAGE_SCHEDULER_AUTOSCALE_MODE=observe
PORTAGE_SCHEDULER_AUTOSCALE_MIN_SLOTS=1
PORTAGE_SCHEDULER_AUTOSCALE_MAX_SLOTS=64
PORTAGE_SCHEDULER_AUTOSCALE_TARGET_READY_PER_SLOT=2
PORTAGE_SCHEDULER_AUTOSCALE_COOLDOWN_SECONDS=60
PORTAGE_SCHEDULER_AUTOSCALE_SCALE_DOWN_SECONDS=600
PORTAGE_SCHEDULER_AUTOSCALE_INTERVAL_SECONDS=15
# Must match the provider of every auto-derived catalog image on this stack.
# PVE deployments should supply the remaining CLOUD_PVE_* credentials and
# mounted SSH/builder paths through a secret deployment overlay.
PORTAGE_CLOUD_DEFAULT_PROVIDER=gcp
PORTAGE_SERVER_SECONDARY_PORT=18082
PORTAGE_DASHBOARD_PORT=18081
PORTAGE_GRAFANA_PORT=23000
PORTAGE_LOKI_PORT=23100
PORTAGE_OTEL_HEALTH_PORT=23133
PORTAGE_TEMPO_PORT=23200
PORTAGE_OTLP_GRPC_PORT=24317
PORTAGE_OTLP_HTTP_PORT=24318
PORTAGE_POSTGRES_PORT=25432
PORTAGE_REDIS_PORT=26379
PORTAGE_PROMETHEUS_PORT=29090
PORTAGE_POSTGRES_DB=portage_engine
PORTAGE_POSTGRES_USER=portage
PORTAGE_POSTGRES_PASSWORD=portage-postgres-local
PORTAGE_POSTGRES_APP_USER=portage_app
PORTAGE_POSTGRES_APP_PASSWORD=portage-app-local
PORTAGE_POSTGRES_SIGNER_PASSWORD=portage-signer-local
PORTAGE_POSTGRES_ACTUATOR_PASSWORD=portage-actuator-local
# Opt-in `capacity-actuator` Compose profile. Keep the site-specific JSON out
# of git and use a dedicated PVE account restricted to the approved pool/node.
PORTAGE_CAPACITY_CONFIG_PATH=./configs/capacity-actuator.example.json
PORTAGE_CAPACITY_PVE_TOKEN_ID=
PORTAGE_CAPACITY_PVE_TOKEN_SECRET=
PORTAGE_CAPACITY_PVE_USERNAME=
PORTAGE_CAPACITY_PVE_PASSWORD=
PORTAGE_SCHEDULER_AUTOSCALE_PROVIDER_MAX_SLOTS=pve:64
# Development may leave the key ID empty and auto-create once. Production
# should provision/pin a release subkey and set auto-create to false.
PORTAGE_SIGNER_GPG_KEY_ID=
PORTAGE_SIGNER_GPG_AUTO_CREATE=true
PORTAGE_OTEL_POSTGRES_PASSWORD=portage-otel-local
PORTAGE_REDIS_PASSWORD=portage-redis-local
PORTAGE_RATE_LIMIT_PER_MINUTE=120
PORTAGE_RATE_LIMIT_BURST=30
# IAM-0 migration default. For an OIDC rollout, use hybrid first so the
# dashboard/operator API key remains a break-glass administrator while users
# authenticate with issuer-signed JWTs. Switch to oidc after the WebUI and
# automation no longer depend on the legacy key.
PORTAGE_AUTH_MODE=legacy
PORTAGE_AUTH_PROVIDERS_PATH=
PORTAGE_AUTH_ADMIN_IDENTITIES=
PORTAGE_AUTHENTIK_CLIENT_SECRET=
PORTAGE_GOOGLE_CLIENT_SECRET=
PORTAGE_GITHUB_CLIENT_SECRET=
PORTAGE_API_KEY=
PORTAGE_STEP_UP_API_KEY=
PORTAGE_OIDC_ISSUER_URL=
PORTAGE_OIDC_AUDIENCE=
PORTAGE_OIDC_ADMIN_SUBJECTS=
PORTAGE_OIDC_SESSION_IDLE_MINUTES=60
PORTAGE_OIDC_SESSION_MAX_MINUTES=720
PORTAGE_OIDC_STEP_UP_MAX_AGE_MINUTES=10
PORTAGE_OIDC_STEP_UP_AMR_VALUES=
PORTAGE_OIDC_STEP_UP_ACR_VALUES=
# Trusted-LAN development only. This permits an HTTP issuer but does not
# encrypt bearer tokens between clients and the control plane.
PORTAGE_OIDC_ALLOW_INSECURE_HTTP=false
# Legacy single-OIDC browser compatibility. Prefer AUTH_PROVIDERS_PATH.
PORTAGE_DASHBOARD_OIDC_ENABLED=false
PORTAGE_DASHBOARD_OIDC_CLIENT_ID=
PORTAGE_DASHBOARD_OIDC_CLIENT_SECRET=
PORTAGE_DASHBOARD_OIDC_REDIRECT_URL=http://127.0.0.1:18081/auth/oidc/callback
# Set true when the public Dashboard URL is HTTPS, including when TLS
# terminates at a reverse proxy and the proxy-to-Dashboard hop remains HTTP.
PORTAGE_DASHBOARD_COOKIE_SECURE=false
PORTAGE_PGBACKREST_CIPHER_PASS=replace-with-a-random-backup-encryption-secret
# Point this at an NFS mount backed by the internal NAS in production.
PORTAGE_PGBACKREST_REPO=./backups/pgbackrest
PORTAGE_GRAFANA_USER=admin
PORTAGE_GRAFANA_PASSWORD=portage-grafana-local
PORTAGE_DASHBOARD_USER=admin
PORTAGE_DASHBOARD_PASSWORD=portage-demo
PORTAGE_DASHBOARD_JWT_SECRET=compose-demo-jwt-secret-0123456789abcdef