keyhan
837f0fa63f
Close deployment IDOR and gate stub payment endpoints, add production secret validation, health probes, Redis-backed build progress, GitHub Actions CI, expanded tests, billing/k8s refactors, and ops runbooks. Co-authored-by: Cursor <cursoragent@cursor.com>
98 lines
4.1 KiB
Bash
98 lines
4.1 KiB
Bash
# Environment
|
|
NODE_ENV=development
|
|
PORT=4000
|
|
|
|
|
|
# Database
|
|
DB_HOST=localhost
|
|
DB_PORT=5432
|
|
DB_USERNAME=cloudhost
|
|
DB_PASSWORD=cloudhost_secret
|
|
DB_DATABASE=cloudhost
|
|
|
|
# JWT
|
|
JWT_SECRET=your-super-secret-jwt-key-change-in-production
|
|
JWT_EXPIRES_IN=1h
|
|
JWT_REFRESH_SECRET=your-refresh-secret-key-change-in-production
|
|
JWT_REFRESH_EXPIRES_IN=7d
|
|
|
|
# Redis
|
|
REDIS_HOST=localhost
|
|
REDIS_PORT=6379
|
|
|
|
# Multi-cluster: AES-256-GCM key for encrypting kubeconfigs at rest (required in production).
|
|
# Generate with: openssl rand -hex 32
|
|
CLUSTER_KUBECONFIG_KEY=
|
|
|
|
# Stub payment gateway (dev/staging only — disabled in production unless explicitly enabled)
|
|
# PAYMENT_GATEWAY_STUB_ENABLED=true
|
|
|
|
# ─── OTP SMS ────────────────────────────────────────────────────────────────
|
|
# Pick the provider. Without valid credentials, OTP codes are logged to the API
|
|
# console in development only; in production a missing config makes OTP send fail
|
|
# (registration + passwordless login return 503).
|
|
SMS_PROVIDER=mizbansms # "mizbansms" (default) | "kavenegar"
|
|
|
|
# MizbanSMS (services.mizbansms.com) — sends the full OTP text over a dedicated
|
|
# line. USERNAME/PASSWORD are required; FROM/API/USERTYPE come from your panel.
|
|
# `Api` is the *active route* number for the FROM line (ask support if 1008).
|
|
MIZBANSMS_USERNAME=
|
|
MIZBANSMS_PASSWORD=
|
|
MIZBANSMS_FROM=5000467254
|
|
MIZBANSMS_API=2016
|
|
MIZBANSMS_USERTYPE=2 # 2 = customer account, 1 = reseller
|
|
# Per-flow message text; `{code}` (or `{{CODE}}`) is replaced with the 6-digit OTP.
|
|
# Defaults are sensible Persian wording — override only to customise.
|
|
# MIZBANSMS_OTP_TEMPLATE_REGISTER=به ابربان خوش آمدید.\nکد تأیید شما: {code}
|
|
# MIZBANSMS_OTP_TEMPLATE_LOGIN=رمز یکبار مصرف ابربان:\n{code}
|
|
# MIZBANSMS_OTP_TEMPLATE_CHANGE_PHONE=کد تأیید شماره جدید ابربان:\n{code}
|
|
|
|
# Kavenegar (verify/lookup template API) — only used when SMS_PROVIDER=kavenegar.
|
|
# Create an approved OTP template in the panel; it must contain a %token placeholder.
|
|
KAVENEGAR_API_KEY=
|
|
KAVENEGAR_OTP_TEMPLATE=
|
|
|
|
# Seed admin mobile (login is mobile-only) — used by `npm run seed`.
|
|
ADMIN_PHONE=09120000000
|
|
|
|
# In-cluster Docker Registry (Kaniko push + app image pull — same URL)
|
|
REGISTRY_URL=registry.cloudhost-builds.svc.cluster.local:5000
|
|
# REGISTRY_PULL_URL=registry.cloudhost-builds.svc.cluster.local:5000
|
|
REGISTRY_USERNAME=admin
|
|
REGISTRY_PASSWORD=registry_secret
|
|
|
|
# Central logging (Elasticsearch + Kibana)
|
|
# In-cluster backend: leave ELASTICSEARCH_HOST unset (uses elasticsearch.logging.svc.cluster.local).
|
|
# Local backend (npm run dev): defaults to 127.0.0.1 and auto-runs kubectl port-forward to the default cluster.
|
|
# ELASTICSEARCH_HOST=127.0.0.1
|
|
# ELASTICSEARCH_PORT=9200
|
|
# ELASTICSEARCH_AUTO_PORT_FORWARD=false
|
|
# ELASTIC_PASSWORD=CloudHost2024!Secure
|
|
# KIBANA_SYSTEM_PASSWORD=Kibana2024!System
|
|
# LOGGING_ELASTICSEARCH_IMAGE=localhost:30500/elasticsearch:8.12.0
|
|
# LOGGING_KIBANA_IMAGE=localhost:30500/kibana:8.12.0
|
|
|
|
# Build
|
|
BUILD_NAMESPACE=cloudhost-builds
|
|
BUILD_SERVICE_ACCOUNT=kaniko-builder
|
|
|
|
# Platform
|
|
# Public URL(s) of the frontend — used for CORS and to derive the platform/preview
|
|
# domains. May be a comma-separated list of origins (first one drives domain resolution).
|
|
FRONTEND_URL=http://localhost:3000
|
|
PLATFORM_DOMAIN=apps.cloudhost.local
|
|
# Base domain for per-user preview URLs (<userId>-<7-digit>.<base-domain>).
|
|
# Falls back to the root domain derived from FRONTEND_URL when unset.
|
|
# PREVIEW_BASE_DOMAIN=3fase.ir
|
|
# Ingress controller class for app Ingress + ACME HTTP-01 solver.
|
|
# k3s default is Traefik; use "nginx" only on clusters running ingress-nginx.
|
|
# INGRESS_CLASS=traefik
|
|
UPLOAD_DIR=./uploads
|
|
# PVC resize: use a dynamic StorageClass with allowVolumeExpansion (k3s: rancher.io/local-path)
|
|
# k3s: use local-path and skip creating a custom class (set CREATE=false)
|
|
# PLATFORM_STORAGE_CLASS=local-path
|
|
# PLATFORM_CREATE_STORAGE_CLASS=false
|
|
PLATFORM_STORAGE_CLASS=cloudhost-expandable
|
|
PLATFORM_CREATE_STORAGE_CLASS=true
|
|
PLATFORM_STORAGE_PROVISIONER=rancher.io/local-path
|