124 lines
4.4 KiB
Plaintext
124 lines
4.4 KiB
Plaintext
# Base application configuration
|
|
NODE_ENV=production
|
|
|
|
# Public URLs
|
|
SERVER_IP=192.168.x.x
|
|
APP_PUBLIC_URL=https://your-domain.example.com
|
|
NEXTAUTH_URL=https://your-domain.example.com
|
|
NEXTAUTH_SECRET=replace-with-strong-secret
|
|
LICENSE_SERVER_URL=https://your-license-server.example.com
|
|
LICENSE_PROJECT_CODE=flnxi-sucai
|
|
# Shared HMAC secret between material app and license server (minimum 32 characters)
|
|
LICENSE_REQUEST_SIGNING_SECRET=replace-with-shared-license-request-secret
|
|
|
|
# Versioned deployment images
|
|
# Customer delivery must pin the full application image tag. Do not rely on latest.
|
|
APP_IMAGE=registry.example.com/flnxi/material/flnxi-material:1.0.0
|
|
# Optional: pin runtime images to your private Registry for offline or controlled delivery.
|
|
POSTGRES_IMAGE=postgres:15-alpine
|
|
MINIO_IMAGE=minio/minio:RELEASE.2025-04-22T22-12-26Z
|
|
MINIO_MC_IMAGE=minio/mc:RELEASE.2025-04-16T18-13-26Z
|
|
|
|
# Shared-machine isolation (recommended on test servers with multiple projects)
|
|
COMPOSE_PROJECT_NAME=flnxi_sucai
|
|
APP_CONTAINER_NAME=flnxi-material
|
|
POSTGRES_CONTAINER_NAME=flnxi-postgres
|
|
MINIO_CONTAINER_NAME=flnxi-minio
|
|
MINIO_INIT_CONTAINER_NAME=flnxi-minio-init
|
|
POSTGRES_VOLUME_NAME=flnxi-postgres-data
|
|
MINIO_VOLUME_NAME=flnxi-minio-data
|
|
APP_NETWORK_NAME=flnxi-app-network
|
|
APP_PORT=4320
|
|
MINIO_API_BIND_HOST=0.0.0.0
|
|
MINIO_API_PORT=9000
|
|
MINIO_CONSOLE_BIND_HOST=127.0.0.1
|
|
MINIO_CONSOLE_PORT=9001
|
|
|
|
# Upload limits, in bytes. Defaults: single file 10GB, total request 10GB, text fields 2MB.
|
|
MAX_UPLOAD_FILE_SIZE_BYTES=10737418240
|
|
MAX_UPLOAD_TOTAL_FILE_SIZE_BYTES=10737418240
|
|
MAX_UPLOAD_FIELD_SIZE_BYTES=2097152
|
|
|
|
# Login protection
|
|
# Defaults: same IP 5 password-login attempts per minute; same account locks for 15 minutes after 5 failures.
|
|
AUTH_LOGIN_IP_WINDOW_MS=60000
|
|
AUTH_LOGIN_IP_MAX_ATTEMPTS=5
|
|
AUTH_LOGIN_ACCOUNT_MAX_FAILURES=5
|
|
AUTH_LOGIN_ACCOUNT_LOCK_MS=900000
|
|
|
|
# Database settings
|
|
# Leave DATABASE_URL empty when using the PostgreSQL service from docker-compose.prod.yml.
|
|
# Fill it only when using an external PostgreSQL database, for example:
|
|
# DATABASE_URL=postgresql://flnxi:<strong-password>@192.168.1.10:5432/flnxi?sslmode=disable
|
|
DATABASE_URL=
|
|
POSTGRES_USER=postgres
|
|
POSTGRES_PASSWORD=replace-with-strong-postgres-password
|
|
POSTGRES_DB=flnxi
|
|
|
|
# Object storage (S3 compatible)
|
|
STORAGE_PROVIDER=s3
|
|
# Default values below match the built-in MinIO service in docker-compose.prod.yml.
|
|
# For external S3/MinIO, replace S3_ENDPOINT, S3_PUBLIC_DOMAIN, access key, and secret key.
|
|
S3_ENDPOINT=http://minio:9000
|
|
S3_BUCKET=flnxi-materials
|
|
S3_ACCESS_KEY_ID=
|
|
S3_SECRET_ACCESS_KEY=
|
|
S3_REGION=us-east-1
|
|
S3_PUBLIC_DOMAIN=http://192.168.x.x:9000/flnxi-materials
|
|
S3_SET_ACL=0
|
|
S3_FILE_PATH=materials/
|
|
S3_ENV_PREFIX=
|
|
MINIO_ROOT_USER=replace-with-minio-admin-user
|
|
MINIO_ROOT_PASSWORD=replace-with-strong-minio-admin-password
|
|
|
|
# Vector database (optional)
|
|
VECTOR_DB=pgvector
|
|
PGVECTOR_DB_URL=
|
|
|
|
# DingTalk login (optional)
|
|
DINGTALK_CLIENT_ID=
|
|
DINGTALK_CLIENT_SECRET=
|
|
NEXT_PUBLIC_DINGTALK_CALLBACK_URL=
|
|
|
|
# Frontend display
|
|
NEXT_PUBLIC_DEFAULT_HEADER_LOGO_URL=
|
|
NEXT_PUBLIC_DEFAULT_LOGIN_LOGO_URL=
|
|
NEXT_PUBLIC_INTRANET_URL=
|
|
NEXT_PUBLIC_PORTAL_BASE_URL=
|
|
NEXT_PUBLIC_PUBLIC_DOMAINS=portal.example.com
|
|
PUBLIC_DOMAINS=portal.example.com
|
|
|
|
# CORS and image whitelist
|
|
ALLOWED_ORIGINS=https://portal.example.com
|
|
IMAGE_REMOTE_HOSTS=s3.example.com
|
|
|
|
# License system security (REQUIRED for license validation)
|
|
# RSA public key for license signature verification (PEM format, replace \n with \\n)
|
|
LICENSE_PUBLIC_KEY=
|
|
# Local encryption key for secure storage (minimum 32 characters)
|
|
LOCAL_ENCRYPTION_KEY=
|
|
# Optional: one-time token for manual POST /api/system/init before any admin exists
|
|
SYSTEM_INIT_TOKEN=
|
|
# Optional: explicit initial admin identity; password omitted means generate a one-time password during initialization
|
|
INIT_ADMIN_EMAIL=admin@local.flnxi
|
|
INIT_ADMIN_PASSWORD=
|
|
|
|
# Legacy one-off data restore endpoint. Keep disabled in customer environments unless doing a controlled restore window.
|
|
RESTORE_DATA_ENABLED=0
|
|
RESTORE_DATA_TOKEN=
|
|
RESTORE_DATA_ALLOWED_IPS=127.0.0.1
|
|
# Only set to 1 when the app is behind a trusted reverse proxy that strips untrusted forwarding headers.
|
|
RESTORE_DATA_TRUST_PROXY=0
|
|
RESTORE_ADMIN_EMAIL=admin@local.flnxi
|
|
RESTORE_ADMIN_USERNAME=admin
|
|
RESTORE_ADMIN_PASSWORD=
|
|
RESTORE_S3_BUCKET_URL=
|
|
RESTORE_S3_PUBLIC_URL=
|
|
|
|
# AI model (optional)
|
|
GEMINI_API_KEY=
|
|
GEMINI_API_BASE_URL=https://api.huandutech.com/v1
|
|
GEMINI_MODEL=gemini-2.0-flash-exp
|
|
|
|
# Append other custom variables below
|