mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
61a8a2765b
Follow-up to #2379. NOMINATIM_URL arrives from a compose file or a ConfigMap with whatever whitespace was typed around it. The schema validates the trimmed string and calls a blank one unset, the derivation did neither, so " " passed startup as "use the default" and then became the base URL that cannot be fetched, and a padded value lost every geocoding call the same way. It trims now, which is also what the places client next door does with its own override. The chart could not pass the variable at all: the ConfigMap is an allowlist and an unknown key is dropped without a word, which is exactly the locked-down cluster the override exists for. The docs said what to set and not what it costs. They now say that it replaces the public service with no fallback, that the endpoint has to speak the Nominatim API, and that the one-per-second spacing stays either way, so nobody stands up their own instance expecting it to run faster. Test IDs follow the file again.
181 lines
8.2 KiB
YAML
181 lines
8.2 KiB
YAML
|
|
image:
|
|
repository: mauriceboe/trek
|
|
# tag: latest
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Deployment update strategy. Recreate is the safe default for the single-writer SQLite
|
|
# DB on a ReadWriteOnce volume (the old pod is torn down before the new one starts).
|
|
# Set to RollingUpdate only if you back the data volume with ReadWriteMany storage.
|
|
updateStrategy: Recreate
|
|
|
|
# Optional image pull secrets for private registries
|
|
imagePullSecrets: []
|
|
# - name: my-registry-secret
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 3000
|
|
|
|
env:
|
|
NODE_ENV: production
|
|
PORT: 3000
|
|
# TZ: "UTC"
|
|
# Timezone for logs, reminders, and cron jobs (e.g. Europe/Berlin).
|
|
# LOG_LEVEL: "info"
|
|
# "info" = concise user actions, "debug" = verbose details.
|
|
# TREK_WIKI_DIR: "/app/wiki"
|
|
# Where the in-app Help pages (/help) read their content from. Leave unset: the
|
|
# image ships the wiki at /app/wiki and finds it automatically, so Help matches
|
|
# the version you are running. Only set this to serve your own docs from a mounted
|
|
# volume. If the path does not exist, Help falls back to fetching the public GitHub
|
|
# wiki, which needs egress and tracks the latest release rather than your version.
|
|
# DEFAULT_LANGUAGE: "en"
|
|
# Default language on the login page for users with no saved preference.
|
|
# Browser/OS language is auto-detected first; this is the fallback when no match is found.
|
|
# Supported: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar
|
|
# ALLOWED_ORIGINS: ""
|
|
# NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
|
|
# APP_URL: "https://trek.example.com"
|
|
# Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
|
|
# Also used as the base URL for links in email notifications and other external links.
|
|
# FORCE_HTTPS: "false"
|
|
# Optional. When "true": HTTPS redirect, HSTS, CSP upgrade-insecure-requests, secure cookies. Only behind a TLS proxy. Requires TRUST_PROXY.
|
|
# HSTS_INCLUDE_SUBDOMAINS: "false"
|
|
# When "true": adds includeSubDomains to the HSTS header. Only effective when HSTS is active. Leave "false" if sibling subdomains still run over plain HTTP.
|
|
# COOKIE_SECURE: "true"
|
|
# Auto-derived (true in production or when FORCE_HTTPS=true). Set "false" to force cookies over plain HTTP. Not recommended for production.
|
|
# SESSION_DURATION: "24h"
|
|
# How long a login session stays valid when "Remember me" is unchecked (the default): trek_session JWT exp + a browser-session cookie. Accepts 1h, 12h, 7d, 30d, 90d. Defaults to 24h.
|
|
# SESSION_DURATION_REMEMBER: "30d"
|
|
# Session length when "Remember me" is ticked: a longer-lived JWT + persistent cookie that survives browser restarts. Same format as SESSION_DURATION. Defaults to 30d.
|
|
# TRUST_PROXY: "1"
|
|
# Trusted proxy hops for X-Forwarded-For/X-Forwarded-Proto. Defaults to 1 in production. Must be set for FORCE_HTTPS to work.
|
|
# ALLOW_INTERNAL_NETWORK: "false"
|
|
# Set to "true" if Immich or other integrated services are hosted on a private/RFC-1918 network address.
|
|
# Loopback (127.x) and link-local/metadata addresses (169.254.x) are always blocked.
|
|
# OIDC_ISSUER: ""
|
|
# OpenID Connect provider URL.
|
|
# OIDC_CLIENT_ID: ""
|
|
# OIDC client ID.
|
|
# OIDC_DISPLAY_NAME: "SSO"
|
|
# Label shown on the SSO login button.
|
|
# OIDC_ONLY: "false"
|
|
# Set to "true" to force SSO-only mode: disables password login and password registration.
|
|
# Overrides the granular toggles in Admin > Settings and cannot be changed at runtime.
|
|
# First SSO login becomes admin on a fresh instance.
|
|
# OIDC_ADMIN_CLAIM: ""
|
|
# OIDC claim used to identify admin users.
|
|
# OIDC_ADMIN_VALUE: ""
|
|
# Value of the OIDC claim that grants admin role.
|
|
# OIDC_SCOPE: "openid email profile groups"
|
|
# Space-separated OIDC scopes to request. Must include scopes for any claim used by OIDC_ADMIN_CLAIM.
|
|
# OIDC_DISCOVERY_URL: ""
|
|
# Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik).
|
|
# DEMO_MODE: "false"
|
|
# Enable demo mode (hourly data resets).
|
|
# MCP_RATE_LIMIT: "300"
|
|
# Max MCP API requests per user per minute. Defaults to 300.
|
|
# MCP_MAX_SESSION_PER_USER: "20"
|
|
# Max concurrent MCP sessions per user. Defaults to 20.
|
|
# NOMINATIM_URL: ""
|
|
# Custom Nominatim base URL for every geocoding call the server makes (place search, reverse lookup, Atlas region
|
|
# fill). When set it REPLACES the public OpenStreetMap service, with no fallback, so the instance behind it needs
|
|
# the coverage you expect and has to speak the Nominatim API. TREK keeps its ~1 request per second spacing either
|
|
# way. Defaults to https://nominatim.openstreetmap.org.
|
|
# OVERPASS_URL: ""
|
|
# Custom Overpass endpoint(s) for the map POI "explore" search, comma-separated. When set, REPLACES the bundled
|
|
# public mirrors — point it at an internal/self-hosted Overpass instance when the public mirrors are unreachable
|
|
# from the cluster (e.g. locked-down egress). Non-http(s) entries are ignored.
|
|
# OVERPASS_TIMEOUT_MS: "12000"
|
|
# Per-endpoint timeout (ms) for Overpass POI requests. Raise it for a slow self-hosted Overpass instance. Defaults to 12000.
|
|
|
|
|
|
# Secret environment variables stored in a Kubernetes Secret.
|
|
# JWT_SECRET is managed entirely by the server (auto-generated into the data PVC,
|
|
# rotatable via the admin panel) — it is not configured here.
|
|
secretEnv:
|
|
# At-rest encryption key for stored secrets (API keys, MFA, SMTP, OIDC, etc.).
|
|
# Recommended: set to a random 32-byte hex value (openssl rand -hex 32).
|
|
# If left empty the server resolves the key automatically:
|
|
# 1. data/.jwt_secret (existing installs — encrypted data stays readable after upgrade)
|
|
# 2. data/.encryption_key auto-generated on first start (fresh installs)
|
|
ENCRYPTION_KEY: ""
|
|
# Initial admin account — only used on first boot when no users exist yet.
|
|
# If both values are non-empty the admin account is created with these credentials.
|
|
# If either is empty a random password is generated and printed to the server log.
|
|
ADMIN_EMAIL: ""
|
|
ADMIN_PASSWORD: ""
|
|
# OIDC client secret — set together with env.OIDC_ISSUER and env.OIDC_CLIENT_ID.
|
|
OIDC_CLIENT_SECRET: ""
|
|
# Optional Unsplash Access Key for trip-cover and place-image search.
|
|
# Without one, TREK uses Unsplash's unauthenticated endpoint, which some
|
|
# datacenter/VPS IPs (including many Kubernetes clusters) are blocked from.
|
|
# Get a free key at https://unsplash.com/developers. Can also be set per-admin
|
|
# in Admin > Settings; this value overrides that. Leave empty to disable.
|
|
UNSPLASH_ACCESS_KEY: ""
|
|
|
|
# If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades
|
|
generateEncryptionKey: false
|
|
|
|
# If set, use an existing Kubernetes secret that contains ENCRYPTION_KEY
|
|
existingSecret: ""
|
|
existingSecretKey: ENCRYPTION_KEY
|
|
|
|
persistence:
|
|
# When disabled, volumes fall back to an ephemeral emptyDir (data lost on pod restart).
|
|
enabled: true
|
|
data:
|
|
size: 1Gi
|
|
# Leave empty to use the cluster's default StorageClass; set to bind a specific class.
|
|
storageClassName: ""
|
|
# Bind an existing PVC. The other values (size, storageClassName, annotations) are then ignored.
|
|
existingClaim: ""
|
|
annotations: {}
|
|
uploads:
|
|
size: 1Gi
|
|
storageClassName: ""
|
|
# Specify an existing PVC to bind. The other values are then ignored.
|
|
existingClaim: ""
|
|
annotations: {}
|
|
|
|
# Readiness and liveness probes. Overrides are merged over these defaults, so a key you
|
|
# do not set stays as shipped: --set probes.liveness.initialDelaySeconds=60 keeps the
|
|
# httpGet handler. Switching handler means clearing the old one in the same override
|
|
# (httpGet: null together with tcpSocket), otherwise the API rejects the pod with
|
|
# "may not specify more than 1 handler type". Set probes.liveness to null to drop a probe.
|
|
probes:
|
|
liveness:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3000
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 30
|
|
readiness:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3000
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
hosts:
|
|
- host: chart-example.local
|
|
paths:
|
|
- /
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - chart-example.local
|