mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
7cfec6452d
A rootless Podman container reaches its host through 169.254.1.2, and an identity provider behind that address failed the OIDC login with "Requests to link-local / cloud-metadata addresses are not allowed", with no setting to change it. ALLOW_LINK_LOCAL_IPS names single link-local IPv4 addresses that may be reached after all. The admin-configured lane (OIDC, AI parsing, plugin OAuth, routing engines) reaches a listed address directly; the guard on user-supplied URLs treats it as internal, so it also needs ALLOW_INTERNAL_NETWORK there. 169.254.169.0/24 and 169.254.170.0/24, where clouds serve instance metadata and credentials, cannot be listed, and an entry that is not one link-local IPv4 aborts startup. Unset, nothing changes. Closes #2400
88 lines
3.0 KiB
YAML
88 lines
3.0 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "trek.fullname" . }}-config
|
|
labels:
|
|
app: {{ include "trek.name" . }}
|
|
data:
|
|
NODE_ENV: {{ .Values.env.NODE_ENV | quote }}
|
|
PORT: {{ .Values.env.PORT | quote }}
|
|
{{- if .Values.env.TZ }}
|
|
TZ: {{ .Values.env.TZ | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.LOG_LEVEL }}
|
|
LOG_LEVEL: {{ .Values.env.LOG_LEVEL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.TREK_WIKI_DIR }}
|
|
TREK_WIKI_DIR: {{ .Values.env.TREK_WIKI_DIR | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.ALLOWED_ORIGINS }}
|
|
ALLOWED_ORIGINS: {{ .Values.env.ALLOWED_ORIGINS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.APP_URL }}
|
|
APP_URL: {{ .Values.env.APP_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.FORCE_HTTPS }}
|
|
FORCE_HTTPS: {{ .Values.env.FORCE_HTTPS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.HSTS_INCLUDE_SUBDOMAINS }}
|
|
HSTS_INCLUDE_SUBDOMAINS: {{ .Values.env.HSTS_INCLUDE_SUBDOMAINS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.COOKIE_SECURE }}
|
|
COOKIE_SECURE: {{ .Values.env.COOKIE_SECURE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.SESSION_DURATION }}
|
|
SESSION_DURATION: {{ .Values.env.SESSION_DURATION | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.SESSION_DURATION_REMEMBER }}
|
|
SESSION_DURATION_REMEMBER: {{ .Values.env.SESSION_DURATION_REMEMBER | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.TRUST_PROXY }}
|
|
TRUST_PROXY: {{ .Values.env.TRUST_PROXY | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.ALLOW_INTERNAL_NETWORK }}
|
|
ALLOW_INTERNAL_NETWORK: {{ .Values.env.ALLOW_INTERNAL_NETWORK | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.ALLOW_LINK_LOCAL_IPS }}
|
|
ALLOW_LINK_LOCAL_IPS: {{ .Values.env.ALLOW_LINK_LOCAL_IPS | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ISSUER }}
|
|
OIDC_ISSUER: {{ .Values.env.OIDC_ISSUER | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_CLIENT_ID }}
|
|
OIDC_CLIENT_ID: {{ .Values.env.OIDC_CLIENT_ID | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_DISPLAY_NAME }}
|
|
OIDC_DISPLAY_NAME: {{ .Values.env.OIDC_DISPLAY_NAME | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ONLY }}
|
|
OIDC_ONLY: {{ .Values.env.OIDC_ONLY | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ADMIN_CLAIM }}
|
|
OIDC_ADMIN_CLAIM: {{ .Values.env.OIDC_ADMIN_CLAIM | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_ADMIN_VALUE }}
|
|
OIDC_ADMIN_VALUE: {{ .Values.env.OIDC_ADMIN_VALUE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_SCOPE }}
|
|
OIDC_SCOPE: {{ .Values.env.OIDC_SCOPE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OIDC_DISCOVERY_URL }}
|
|
OIDC_DISCOVERY_URL: {{ .Values.env.OIDC_DISCOVERY_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.DEMO_MODE }}
|
|
DEMO_MODE: {{ .Values.env.DEMO_MODE | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.MCP_RATE_LIMIT }}
|
|
MCP_RATE_LIMIT: {{ .Values.env.MCP_RATE_LIMIT | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.NOMINATIM_URL }}
|
|
NOMINATIM_URL: {{ .Values.env.NOMINATIM_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OVERPASS_URL }}
|
|
OVERPASS_URL: {{ .Values.env.OVERPASS_URL | quote }}
|
|
{{- end }}
|
|
{{- if .Values.env.OVERPASS_TIMEOUT_MS }}
|
|
OVERPASS_TIMEOUT_MS: {{ .Values.env.OVERPASS_TIMEOUT_MS | quote }}
|
|
{{- end }}
|