lokses
33c43c9c7d
Пример окружения больше не раскрывает топологию сети: - ALLOWED_HOSTS: убран 10.10.31.3 (оставлены localhost/127.0.0.1) - DATABASE_URL: 10.10.31.2 → 127.0.0.1 (+ комментарий про <db-host>) - комментарий Traefik: 10.10.31.3 → <portal-lan-ip> Секретов не было (SECRET_KEY/пароли = CHANGE_ME/пусто) — только IP. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
65 lines
3.0 KiB
Bash
65 lines
3.0 KiB
Bash
# Django
|
||
# За Traefik: acore.settings.production, DEBUG=False, gunicorn на :8000 внутри LXC.
|
||
DJANGO_SETTINGS_MODULE=acore.settings.local
|
||
DEBUG=True
|
||
SECRET_KEY=change-me-in-production
|
||
ALLOWED_HOSTS=localhost,127.0.0.1
|
||
# Публичное имя через Traefik (Host rule) и LAN-IP портала — добавьте к ALLOWED_HOSTS:
|
||
# ALLOWED_HOSTS=portal.example.local,<portal-lan-ip>
|
||
# PORTAL_BASE_URL=https://portal.example.local
|
||
# CSRF_TRUSTED_ORIGINS=https://portal.example.local
|
||
# <db-host>: localhost для локальной БД или LAN-IP/хост сервера БД в проде.
|
||
DATABASE_URL=postgres://acore:CHANGE_ME@127.0.0.1:5432/acore
|
||
|
||
# Fernet field encryption for ConnectorConfig / bot tokens / Carbonio passwords.
|
||
# MUST be set in production (acore.settings.production refuses empty value).
|
||
# Keep equal to the key used when secrets were encrypted, or re-encrypt after rotation.
|
||
# Prefer a value DISTINCT from SECRET_KEY once you are ready to rotate.
|
||
FIELD_ENCRYPTION_KEY=
|
||
|
||
# Mattermost integrations (fail-closed when empty)
|
||
MATTERMOST_SLASH_COMMAND_TOKEN=
|
||
# Interactive button actions; defaults to slash token if unset
|
||
MATTERMOST_INTERACTIVE_TOKEN=
|
||
PORTAL_BASE_URL=http://localhost:8000
|
||
|
||
# Карты Leaflet: CARTO basemaps требуют бесплатный API key (иначе — OpenStreetMap).
|
||
# https://carto.com/basemaps/apikey/
|
||
# CARTO_BASEMAPS_API_KEY=
|
||
|
||
# ACORE → PNMS identity sync (must match PNMS ACORE_SYNC_TOKEN).
|
||
# В production DEBUG=False требует https:// — в payload уходит password_hash (PBKDF2).
|
||
# PNMS_SYNC_ENABLED=1
|
||
# PNMS_BASE_URL=https://pnms.example
|
||
# PNMS_ACORE_TOKEN=
|
||
|
||
# ACORE → MSORTER (сотрудники в группе «Почта»). Токен = MSORTER ACORE_SYNC_TOKEN.
|
||
# В production DEBUG=False требует https://.
|
||
# MSORTER_SYNC_ENABLED=1
|
||
# MSORTER_BASE_URL=https://msorter.example
|
||
# MSORTER_ACORE_TOKEN=
|
||
|
||
# ACORE → PVMS (посещаемость). Токен = PVMS ACORE_SYNC_TOKEN.
|
||
# PVMS_ATTENDANCE_SOT=1 после dump: портал и /api/attendance/register/ идут в PVMS.
|
||
# PVMS_SYNC_ENABLED=1
|
||
# PVMS_BASE_URL=https://pvms.example
|
||
# PVMS_ACORE_TOKEN=
|
||
# PVMS_REPORT_TOKEN= # опционально отдельный для /api/reports/; иначе = ACORE_TOKEN
|
||
# PVMS_ATTENDANCE_SOT=0
|
||
|
||
# Redis cache for production (login throttle across workers). Separate DB from Celery /0.
|
||
# Production требует пароль в URL (requirepass). Временно: REDIS_ALLOW_UNAUTHENTICATED=1.
|
||
# CACHE_URL=redis://:CHANGE_ME@127.0.0.1:6379/1
|
||
# CELERY_BROKER_URL=redis://:CHANGE_ME@127.0.0.1:6379/0
|
||
# CELERY_RESULT_BACKEND=redis://:CHANGE_ME@127.0.0.1:6379/0
|
||
# REDIS_ALLOW_UNAUTHENTICATED=1
|
||
|
||
# SILO / S3-compatible media (django-storages). Docs: docs/silo.md
|
||
# When set, ImageField/FileField go to bucket; leave empty for local MEDIA_ROOT.
|
||
# S3_ENDPOINT=https://s3.example.local:9000
|
||
# S3_ACCESS_KEY=acore-media-rw
|
||
# S3_SECRET_KEY=
|
||
# S3_MEDIA_BUCKET=acore-media
|
||
# S3_REGION=us-east-1
|
||
# S3_QUERYSTRING_EXPIRE=3600
|