mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
jubnl
6c87bf2f7a
The /help pages fetched their markdown from raw.githubusercontent.com at
runtime, so a self-hosted install was served docs from main rather than the
version it was actually running, and help was unusable without network access.
The wiki/ directory was in the repo the whole time; the bundled-snapshot
fallback the code reached for was gitignored and never populated by any build
step, so it was dead code.
Read wiki/ straight from disk instead. server/{src,dist}/services both sit
three levels under the repo root, so a single __dirname anchor resolves in dev,
a built source install, vitest and Docker with no copy or build step. GitHub is
kept strictly as a fallback for when the directory cannot be resolved, decided
once at load by probing for _Sidebar.md: a page missing from a present wiki is
a genuine 404, since falling back per-file would reintroduce the version skew
this removes.
Ship wiki/ in the image: .dockerignore excluded it outright, so the COPY alone
would have produced an image with no wiki, and the GitHub fallback would have
masked that at runtime. Add a real path-containment check on assets now that
the path becomes a filesystem read rather than a URL, and document
TREK_WIKI_DIR as an off-by-default escape hatch across the deployment configs.
157 lines
7.2 KiB
YAML
157 lines
7.2 KiB
YAML
|
|
image:
|
|
repository: mauriceboe/trek
|
|
# tag: latest
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Deployment update strategy. Recreate is the safe default for the single-writer SQLite
|
|
# DB on a ReadWriteOnce volume (the old pod is torn down before the new one starts).
|
|
# Set to RollingUpdate only if you back the data volume with ReadWriteMany storage.
|
|
updateStrategy: Recreate
|
|
|
|
# Optional image pull secrets for private registries
|
|
imagePullSecrets: []
|
|
# - name: my-registry-secret
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 3000
|
|
|
|
env:
|
|
NODE_ENV: production
|
|
PORT: 3000
|
|
# TZ: "UTC"
|
|
# Timezone for logs, reminders, and cron jobs (e.g. Europe/Berlin).
|
|
# LOG_LEVEL: "info"
|
|
# "info" = concise user actions, "debug" = verbose details.
|
|
# TREK_WIKI_DIR: "/app/wiki"
|
|
# Where the in-app Help pages (/help) read their content from. Leave unset: the
|
|
# image ships the wiki at /app/wiki and finds it automatically, so Help matches
|
|
# the version you are running. Only set this to serve your own docs from a mounted
|
|
# volume. If the path does not exist, Help falls back to fetching the public GitHub
|
|
# wiki, which needs egress and tracks the latest release rather than your version.
|
|
# DEFAULT_LANGUAGE: "en"
|
|
# Default language on the login page for users with no saved preference.
|
|
# Browser/OS language is auto-detected first; this is the fallback when no match is found.
|
|
# Supported: de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar
|
|
# ALLOWED_ORIGINS: ""
|
|
# NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
|
|
# APP_URL: "https://trek.example.com"
|
|
# Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
|
|
# Also used as the base URL for links in email notifications and other external links.
|
|
# FORCE_HTTPS: "false"
|
|
# Optional. When "true": HTTPS redirect, HSTS, CSP upgrade-insecure-requests, secure cookies. Only behind a TLS proxy. Requires TRUST_PROXY.
|
|
# HSTS_INCLUDE_SUBDOMAINS: "false"
|
|
# When "true": adds includeSubDomains to the HSTS header. Only effective when HSTS is active. Leave "false" if sibling subdomains still run over plain HTTP.
|
|
# COOKIE_SECURE: "true"
|
|
# Auto-derived (true in production or when FORCE_HTTPS=true). Set "false" to force cookies over plain HTTP. Not recommended for production.
|
|
# SESSION_DURATION: "24h"
|
|
# How long a login session stays valid when "Remember me" is unchecked (the default): trek_session JWT exp + a browser-session cookie. Accepts 1h, 12h, 7d, 30d, 90d. Defaults to 24h.
|
|
# SESSION_DURATION_REMEMBER: "30d"
|
|
# Session length when "Remember me" is ticked: a longer-lived JWT + persistent cookie that survives browser restarts. Same format as SESSION_DURATION. Defaults to 30d.
|
|
# TRUST_PROXY: "1"
|
|
# Trusted proxy hops for X-Forwarded-For/X-Forwarded-Proto. Defaults to 1 in production. Must be set for FORCE_HTTPS to work.
|
|
# ALLOW_INTERNAL_NETWORK: "false"
|
|
# Set to "true" if Immich or other integrated services are hosted on a private/RFC-1918 network address.
|
|
# Loopback (127.x) and link-local/metadata addresses (169.254.x) are always blocked.
|
|
# OIDC_ISSUER: ""
|
|
# OpenID Connect provider URL.
|
|
# OIDC_CLIENT_ID: ""
|
|
# OIDC client ID.
|
|
# OIDC_DISPLAY_NAME: "SSO"
|
|
# Label shown on the SSO login button.
|
|
# OIDC_ONLY: "false"
|
|
# Set to "true" to force SSO-only mode: disables password login and password registration.
|
|
# Overrides the granular toggles in Admin > Settings and cannot be changed at runtime.
|
|
# First SSO login becomes admin on a fresh instance.
|
|
# OIDC_ADMIN_CLAIM: ""
|
|
# OIDC claim used to identify admin users.
|
|
# OIDC_ADMIN_VALUE: ""
|
|
# Value of the OIDC claim that grants admin role.
|
|
# OIDC_SCOPE: "openid email profile groups"
|
|
# Space-separated OIDC scopes to request. Must include scopes for any claim used by OIDC_ADMIN_CLAIM.
|
|
# OIDC_DISCOVERY_URL: ""
|
|
# Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik).
|
|
# DEMO_MODE: "false"
|
|
# Enable demo mode (hourly data resets).
|
|
# MCP_RATE_LIMIT: "300"
|
|
# Max MCP API requests per user per minute. Defaults to 300.
|
|
# MCP_MAX_SESSION_PER_USER: "20"
|
|
# Max concurrent MCP sessions per user. Defaults to 20.
|
|
# OVERPASS_URL: ""
|
|
# Custom Overpass endpoint(s) for the map POI "explore" search, comma-separated. When set, REPLACES the bundled
|
|
# public mirrors — point it at an internal/self-hosted Overpass instance when the public mirrors are unreachable
|
|
# from the cluster (e.g. locked-down egress). Non-http(s) entries are ignored.
|
|
# OVERPASS_TIMEOUT_MS: "12000"
|
|
# Per-endpoint timeout (ms) for Overpass POI requests. Raise it for a slow self-hosted Overpass instance. Defaults to 12000.
|
|
|
|
|
|
# Secret environment variables stored in a Kubernetes Secret.
|
|
# JWT_SECRET is managed entirely by the server (auto-generated into the data PVC,
|
|
# rotatable via the admin panel) — it is not configured here.
|
|
secretEnv:
|
|
# At-rest encryption key for stored secrets (API keys, MFA, SMTP, OIDC, etc.).
|
|
# Recommended: set to a random 32-byte hex value (openssl rand -hex 32).
|
|
# If left empty the server resolves the key automatically:
|
|
# 1. data/.jwt_secret (existing installs — encrypted data stays readable after upgrade)
|
|
# 2. data/.encryption_key auto-generated on first start (fresh installs)
|
|
ENCRYPTION_KEY: ""
|
|
# Initial admin account — only used on first boot when no users exist yet.
|
|
# If both values are non-empty the admin account is created with these credentials.
|
|
# If either is empty a random password is generated and printed to the server log.
|
|
ADMIN_EMAIL: ""
|
|
ADMIN_PASSWORD: ""
|
|
# OIDC client secret — set together with env.OIDC_ISSUER and env.OIDC_CLIENT_ID.
|
|
OIDC_CLIENT_SECRET: ""
|
|
# Optional Unsplash Access Key for trip-cover and place-image search.
|
|
# Without one, TREK uses Unsplash's unauthenticated endpoint, which some
|
|
# datacenter/VPS IPs (including many Kubernetes clusters) are blocked from.
|
|
# Get a free key at https://unsplash.com/developers. Can also be set per-admin
|
|
# in Admin > Settings; this value overrides that. Leave empty to disable.
|
|
UNSPLASH_ACCESS_KEY: ""
|
|
|
|
# If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades
|
|
generateEncryptionKey: false
|
|
|
|
# If set, use an existing Kubernetes secret that contains ENCRYPTION_KEY
|
|
existingSecret: ""
|
|
existingSecretKey: ENCRYPTION_KEY
|
|
|
|
persistence:
|
|
# When disabled, volumes fall back to an ephemeral emptyDir (data lost on pod restart).
|
|
enabled: true
|
|
data:
|
|
size: 1Gi
|
|
# Leave empty to use the cluster's default StorageClass; set to bind a specific class.
|
|
storageClassName: ""
|
|
# Bind an existing PVC. The other values (size, storageClassName, annotations) are then ignored.
|
|
existingClaim: ""
|
|
annotations: {}
|
|
uploads:
|
|
size: 1Gi
|
|
storageClassName: ""
|
|
# Specify an existing PVC to bind. The other values are then ignored.
|
|
existingClaim: ""
|
|
annotations: {}
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
hosts:
|
|
- host: chart-example.local
|
|
paths:
|
|
- /
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - chart-example.local
|