mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-19 13:21:46 +00:00
jubnl
bfd2553d1e
Replaces the coarse oidc_only + allow_registration settings with four independent toggles: password_login, password_registration, oidc_login, oidc_registration. Each can be enabled/disabled individually in Admin > Settings without affecting the others. - Add resolveAuthToggles() in authService.ts as the central resolver; falls back to legacy oidc_only/allow_registration keys when new keys are absent (backward compat) - OIDC_ONLY env var still works and overrides DB toggles for password_*, with a visual lock in the admin UI when active - Server enforces lockout prevention: cannot disable all login methods - oidc_login gate added to OIDC /login and /callback routes - Remove oidc_only toggle from OIDC settings panel; replaced by the granular toggles in the Settings tab - Add 6 new resolveAuthToggles() unit tests; fix AUTH-DB-033 error message assertion - Update OIDC_ONLY descriptions in README, docker-compose, Helm values, Unraid template, and .env.example to clarify override semantics Closes #492
114 lines
4.2 KiB
YAML
114 lines
4.2 KiB
YAML
|
|
image:
|
|
repository: mauriceboe/trek
|
|
# tag: latest
|
|
pullPolicy: IfNotPresent
|
|
|
|
# Optional image pull secrets for private registries
|
|
imagePullSecrets: []
|
|
# - name: my-registry-secret
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 3000
|
|
|
|
env:
|
|
NODE_ENV: production
|
|
PORT: 3000
|
|
# TZ: "UTC"
|
|
# Timezone for logs, reminders, and cron jobs (e.g. Europe/Berlin).
|
|
# LOG_LEVEL: "info"
|
|
# "info" = concise user actions, "debug" = verbose details.
|
|
# ALLOWED_ORIGINS: ""
|
|
# NOTE: If using ingress, ensure env.ALLOWED_ORIGINS matches the domains in ingress.hosts for proper CORS configuration.
|
|
# APP_URL: "https://trek.example.com"
|
|
# Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
|
|
# Also used as the base URL for links in email notifications and other external links.
|
|
# FORCE_HTTPS: "false"
|
|
# Optional. When "true": HTTPS redirect, HSTS, CSP upgrade-insecure-requests, secure cookies. Only behind a TLS proxy. Requires TRUST_PROXY.
|
|
# COOKIE_SECURE: "true"
|
|
# Auto-derived (true in production or when FORCE_HTTPS=true). Set "false" to force cookies over plain HTTP. Not recommended for production.
|
|
# TRUST_PROXY: "1"
|
|
# Trusted proxy hops for X-Forwarded-For/X-Forwarded-Proto. Defaults to 1 in production. Must be set for FORCE_HTTPS to work.
|
|
# ALLOW_INTERNAL_NETWORK: "false"
|
|
# Set to "true" if Immich or other integrated services are hosted on a private/RFC-1918 network address.
|
|
# Loopback (127.x) and link-local/metadata addresses (169.254.x) are always blocked.
|
|
# OIDC_ISSUER: ""
|
|
# OpenID Connect provider URL.
|
|
# OIDC_CLIENT_ID: ""
|
|
# OIDC client ID.
|
|
# OIDC_DISPLAY_NAME: "SSO"
|
|
# Label shown on the SSO login button.
|
|
# OIDC_ONLY: "false"
|
|
# Set to "true" to force SSO-only mode: disables password login and password registration.
|
|
# Overrides the granular toggles in Admin > Settings and cannot be changed at runtime.
|
|
# First SSO login becomes admin on a fresh instance.
|
|
# OIDC_ADMIN_CLAIM: ""
|
|
# OIDC claim used to identify admin users.
|
|
# OIDC_ADMIN_VALUE: ""
|
|
# Value of the OIDC claim that grants admin role.
|
|
# OIDC_SCOPE: "openid email profile groups"
|
|
# Space-separated OIDC scopes to request. Must include scopes for any claim used by OIDC_ADMIN_CLAIM.
|
|
# OIDC_DISCOVERY_URL: ""
|
|
# Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik).
|
|
# DEMO_MODE: "false"
|
|
# Enable demo mode (hourly data resets).
|
|
# MCP_RATE_LIMIT: "300"
|
|
# Max MCP API requests per user per minute. Defaults to 300.
|
|
# MCP_MAX_SESSION_PER_USER: "20"
|
|
# Max concurrent MCP sessions per user. Defaults to 20.
|
|
|
|
|
|
# Secret environment variables stored in a Kubernetes Secret.
|
|
# JWT_SECRET is managed entirely by the server (auto-generated into the data PVC,
|
|
# rotatable via the admin panel) — it is not configured here.
|
|
secretEnv:
|
|
# At-rest encryption key for stored secrets (API keys, MFA, SMTP, OIDC, etc.).
|
|
# Recommended: set to a random 32-byte hex value (openssl rand -hex 32).
|
|
# If left empty the server resolves the key automatically:
|
|
# 1. data/.jwt_secret (existing installs — encrypted data stays readable after upgrade)
|
|
# 2. data/.encryption_key auto-generated on first start (fresh installs)
|
|
ENCRYPTION_KEY: ""
|
|
# Initial admin account — only used on first boot when no users exist yet.
|
|
# If both values are non-empty the admin account is created with these credentials.
|
|
# If either is empty a random password is generated and printed to the server log.
|
|
ADMIN_EMAIL: ""
|
|
ADMIN_PASSWORD: ""
|
|
# OIDC client secret — set together with env.OIDC_ISSUER and env.OIDC_CLIENT_ID.
|
|
OIDC_CLIENT_SECRET: ""
|
|
|
|
# If true, a random ENCRYPTION_KEY is generated at install and preserved across upgrades
|
|
generateEncryptionKey: false
|
|
|
|
# If set, use an existing Kubernetes secret that contains ENCRYPTION_KEY
|
|
existingSecret: ""
|
|
existingSecretKey: ENCRYPTION_KEY
|
|
|
|
persistence:
|
|
enabled: true
|
|
data:
|
|
size: 1Gi
|
|
uploads:
|
|
size: 1Gi
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
|
|
ingress:
|
|
enabled: false
|
|
className: ""
|
|
annotations: {}
|
|
hosts:
|
|
- host: chart-example.local
|
|
paths:
|
|
- /
|
|
tls: []
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - chart-example.local
|