mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:44:33 +00:00
71 lines
3.0 KiB
YAML
71 lines
3.0 KiB
YAML
server:
|
|
port: 8080
|
|
|
|
management:
|
|
endpoints:
|
|
web:
|
|
exposure:
|
|
include: health,info
|
|
|
|
knoe:
|
|
auth:
|
|
enabled: false
|
|
cookieName: knoe_session
|
|
cookieDomain: ${KNOE_AUTH_COOKIE_DOMAIN:.knoe.dev}
|
|
sessionTtl: 8h
|
|
# REQUIRED in production when enabled. Provide via env: KNOE_AUTH_SESSION_SECRET
|
|
sessionSecret: ""
|
|
emailDomain: knoey.com
|
|
formEnabled: false
|
|
# Comma-separated list of bare usernames granted admin group membership.
|
|
# Override via env: KNOE_AUTH_ADMIN_PRINCIPALS=admin
|
|
adminPrincipals: []
|
|
kerberos:
|
|
# REQUIRED for SPNEGO when enabled. Provide via env.
|
|
servicePrincipal: ${KNOE_KERBEROS_SERVICE_PRINCIPAL:}
|
|
keytabPath: ${KNOE_KERBEROS_KEYTAB_PATH:}
|
|
realm: ${KNOE_KERBEROS_REALM:}
|
|
|
|
# ── OIDC Provider (Path B) ───────────────────────────────────────────────
|
|
oidc:
|
|
enabled: ${KNOE_AUTH_OIDC_ENABLED:false}
|
|
issuer: ${KNOE_AUTH_OIDC_ISSUER:https://api.knoe.dev/auth}
|
|
clientId: ${KNOE_AUTH_OIDC_CLIENT_ID:}
|
|
clientSecret: ${KNOE_AUTH_OIDC_CLIENT_SECRET:}
|
|
signingKey: ${KNOE_AUTH_OIDC_SIGNING_KEY:}
|
|
|
|
# ── Enrollment (knoe-auth Round 1) ──────────────────────────────────────
|
|
enroll:
|
|
inviteTtlHours: ${KNOE_ENROLL_INVITE_TTL_HOURS:72}
|
|
otpTtlMinutes: ${KNOE_ENROLL_OTP_TTL_MINUTES:10}
|
|
otpMaxAttempts: ${KNOE_ENROLL_OTP_MAX_ATTEMPTS:3}
|
|
totpIssuer: ${KNOE_ENROLL_TOTP_ISSUER:Knoe.DEV}
|
|
# Base URL used in invite emails and enrollment redirect URIs
|
|
baseUrl: ${KNOE_AUTH_BASE_URL:https://auth.knoe.dev}
|
|
|
|
# ── Google OAuth2 corroboration ──────────────────────────────────────────
|
|
# No allowed-domains list — any Google account is accepted.
|
|
# Trust is established by invite OTP, not the developer's home domain.
|
|
# provider_hd is recorded in knoe.identity for audit only.
|
|
google:
|
|
clientId: ${GOOGLE_CLIENT_ID:}
|
|
clientSecret: ${GOOGLE_CLIENT_SECRET:}
|
|
redirectUri: ${KNOE_AUTH_BASE_URL:https://auth.knoe.dev}/auth/enroll/google-callback
|
|
|
|
# ── Async provisioning worker ─────────────────────────────────────────────
|
|
provisioning:
|
|
pollIntervalMs: ${KNOE_PROVISIONING_POLL_INTERVAL_MS:10000}
|
|
giteaUrl: ${KNOE_GITEA_URL:https://git.knoe.dev}
|
|
giteaToken: ${KNOE_GITEA_TOKEN:}
|
|
|
|
spring:
|
|
# ── Database ─────────────────────────────────────────────────────────────
|
|
datasource:
|
|
url: ${KNOE_DB_URL:jdbc:postgresql://localhost:5432/knoe}
|
|
username: ${KNOE_DB_USER:knoe}
|
|
password: ${KNOE_DB_PASSWORD:}
|
|
driver-class-name: org.postgresql.Driver
|
|
sql:
|
|
init:
|
|
mode: never
|