mirror of
git://f0xx.org/ac/ac-deploy
synced 2026-07-29 09:18:53 +03:00
4d2db29b8b
Add deploy-remote-access-lab.sh, wire WG/RSSH into compose-lab-backend.php, and run RA deploy during populate app phase on primary. Co-authored-by: Cursor <cursoragent@cursor.com>
38 lines
1.4 KiB
Plaintext
38 lines
1.4 KiB
Plaintext
# Lab cluster secrets — COPY to secrets.lab.env on NFS (/shared/cluster/secrets.lab.env)
|
|
# Mode 0600, owner root or deploy user. NOT committed to git.
|
|
#
|
|
# Recoverable via procedures in ac-docs/docs/SECRETS_AND_RECOVERY.md
|
|
|
|
# PHP auth (issues backend) — min 32 chars; changing invalidates sessions
|
|
AUTH_ENCRYPTION_KEY=lab-cluster-dev-32-char-min-secret!!
|
|
|
|
# Gitea mirror automation (optional; else regenerate on cast01)
|
|
# GITEA_MIRROR_ADMIN_TOKEN=
|
|
|
|
# WireGuard lab server (generate new for lab — do not copy prod)
|
|
# WG_SERVER_PRIVATE_KEY=
|
|
# WG_SERVER_PUBLIC_KEY=
|
|
# WG_ENDPOINT=cast01.intra.raptor.org:51820
|
|
# WG_PROVISION_PEERS=1
|
|
|
|
# RSSH bastion (lab)
|
|
# RSSH_BASTION_HOST=cast01.intra.raptor.org
|
|
# RSSH_BASTION_PORT=22
|
|
# RSSH_PROVISION_USERS=1
|
|
|
|
# Iodine DNS tunnel (FE UDP 5350 — dev test password in app dev settings)
|
|
# IODINE_UDP_PORT=5350
|
|
|
|
# Outbound mail (msmtp → Gmail — copy MSMTP_APP_PASSWORD from alpine-be /etc/androidcast/msmtp.secret)
|
|
# Use quotes if the app password contains spaces.
|
|
MAIL_TRANSPORT=sendmail
|
|
MAIL_FROM="Android Cast Lab <bestcastr@gmail.com>"
|
|
MAIL_REPLY_TO=bestcastr@gmail.com
|
|
MSMTP_FROM=bestcastr@gmail.com
|
|
MSMTP_USER=bestcastr@gmail.com
|
|
# MSMTP_APP_PASSWORD="xxxx xxxx xxxx xxxx"
|
|
|
|
# Prod s.f0xx.org shorten API — required for verify-email short links from lab (lab MariaDB ≠ prod).
|
|
# Mint on alpine-be: php81 …/apps/s/scripts/seed_bearer.php --label=auth-email-system
|
|
# URL_SHORTENER_API_BEARER_TOKEN=
|