forked from Janhouse/traefik-proxy-admin
-
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path.env.example
More file actions
96 lines (84 loc) · 4.91 KB
/
Copy path.env.example
File metadata and controls
96 lines (84 loc) · 4.91 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Required: PostgreSQL connection used by the Next.js app and Drizzle.
DATABASE_URL=postgresql://admin:password@localhost:5432/traefik_share
# Optional: Traefik API base URL used only to discover existing Traefik middlewares
# for the service-form middleware dropdown and unknown-middleware warnings.
# This is not required for generating /api/traefik/config. In production,
# middleware discovery is disabled when this is unset; development falls back
# to http://localhost:8080 for the devcontainer Traefik instance.
#
# For production, prefer an internal Docker network, VPN-only address, or other
# protected Traefik API endpoint. Do not expose the Traefik dashboard/API publicly
# without authentication.
# TRAEFIK_API_URL=http://traefik:8080
# Admin authentication is enabled by default. Set a strong secret for signed
# admin session cookies. Use ADMIN_AUTH_PROVIDER=local for first-user setup or
# ADMIN_AUTH_PROVIDER=sso for the configured OIDC provider. Set ADMIN_AUTH_ENABLED=false
# only for trusted local development or automated test runs.
# ADMIN_AUTH_ENABLED=true
# Generate with: openssl rand -base64 48
# ADMIN_AUTH_SECRET=replace-with-generated-random-secret
# ADMIN_AUTH_PROVIDER=local
# ADMIN_COOKIE_DOMAIN=.example.com
# Set false only when serving the admin UI over trusted plain HTTP, such as local/LAN testing.
# ADMIN_COOKIE_SECURE=true
# Optional: service SSO provider configs are managed from Security -> Service SSO
# Configurations. Each service SSO rule can choose a different provider.
#
# Optional: broad service forwardAuth cookie domain. Leave unset for normal
# multi-domain service SSO. TPA uses short-lived auth tickets so each protected
# service can receive a host-scoped traefik-session cookie on its own hostname.
# Set a parent domain only when you intentionally want sibling subdomains to
# share one service forwardAuth session cookie.
# AUTH_COOKIE_DOMAIN=.example.com
# Optional: comma-separated SSO provider hostnames that are allowed to resolve
# to private, local, or reserved IP ranges. Required for intentionally internal
# self-hosted providers such as Authelia, Authentik, Keycloak, or Dex.
# SSO_ENDPOINT_ALLOW_HOSTS=auth.example.internal,authentik.example.internal
# Optional: bearer token accepted only by the DUMB-managed Authelia linker.
# DUMB generates and injects this automatically for its managed TPA service.
# Standalone deployments should leave it unset. If set manually, use at least
# 32 cryptographically random characters and store it as a secret.
# DUMB_INTEGRATION_TOKEN=replace-with-generated-random-secret
# Optional: comma-separated CIDR allowlist for TCP target reachability tests.
# Production target tests are disabled unless this is set. Development defaults
# to loopback and RFC1918/private ranges for devcontainer convenience.
# Example for a private Docker/VPN/LAN deployment:
# TARGET_TEST_ALLOW_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
# Optional: read-only Traefik access log file mounted into the TPA container.
# Enables the Traefik Live log viewer. JSON logs and Traefik default
# extended Common Log Format are supported, so accessLog.format can remain
# unset/common for tools that consume non-JSON logs. Query params with
# common secret names are redacted before entries are returned to the UI.
# TRAEFIK_ACCESS_LOG_PATH=/logs/traefik/access.log
# Optional: emergency break-glass for Native IP Jail enforcement.
# Existing jail decisions remain in the database, but generated Traefik block
# routers are omitted while this is false.
# TPA_IP_JAIL_ENFORCEMENT=true
# Optional: read-only CrowdSec Local API visibility on the Traefik Live page.
# Generate a bouncer API key on the CrowdSec LAPI host:
# sudo cscli bouncers add traefik-proxy-admin
# Bouncer keys can read decisions only; TPA does not need machine credentials
# for this visibility panel.
# CROWDSEC_LAPI_URL=http://crowdsec:8080
# CROWDSEC_BOUNCER_API_KEY=replace-with-generated-bouncer-key
# CROWDSEC_LAPI_TIMEOUT_MS=2500
# Optional: comma-separated hostnames allowed to load Next.js dev resources
# when accessing `pnpm dev` through a reverse proxy such as Traefik.
# NEXT_ALLOWED_DEV_ORIGINS=tpa-dev.example.com
#
# Optional: host/url inputs for `pnpm dev:check-hmr`. These are diagnostic
# only; TPA_DEV_HOST does not replace NEXT_ALLOWED_DEV_ORIGINS.
# TPA_DEV_HOST=tpa-dev.example.com
# TPA_NEXT_DEV_URL=http://127.0.0.1:3000
# TPA_DEV_TRAEFIK_URL=https://127.0.0.1:8081
# TPA_DEV_PUBLIC_URL=https://tpa-dev.example.com
# Optional devcontainer Cloudflare Tunnel token. Set ONE of these values to
# start cloudflared automatically from .devcontainer/start-services.sh.
# CLOUDFLARED_TUNNEL_TOKEN is preferred; TUNNEL_TOKEN is accepted as a
# Cloudflare-style alias. Leave both unset to keep cloudflared disabled.
# Point the Cloudflare Tunnel origin to https://localhost:8081 and enable
# No TLS Verify for the dev Traefik cert.
# CLOUDFLARED_TUNNEL_TOKEN=ey...
# Alternative alias, do not set both:
# TUNNEL_TOKEN=ey...
NEXT_TELEMETRY_DISABLED=1