kzbkowskiandClaude Sonnet 5
b313c126ce
Config backup, a Docker dev/prod split, and a Gitea-built release image.
Added
- /settings -> General -> "Configuration backup": JSON export/import of the
panel's general settings + attribute definitions
(App\Services\ConfigBackupService); audited as config.export / config.import.
Export can leave out the attribute-encryption key. No AD data included.
- docker/compose.dev.yaml: live-reload dev stack that bind-mounts the working
tree. docker/php/Dockerfile is now multi-stage (base -> dev / prod).
- .github/workflows/release.yml: on every vX.Y.Z tag, builds the prod image and
pushes gitea.kzbikowski.pl/kzbkowski/adconsole:{X.Y.Z,X.Y,latest}.
Changed
- docker/compose.yaml: self-contained prod image (app code + composer install
--no-dev baked in via COPY); persistent state in docker/data/{app_storage,db};
defaults to the released image (ADCONSOLE_VERSION pins a tag, ADCONSOLE_IMAGE
replaces the ref). Apache now honours public/.htaccess (AllowOverride All).
Run from the repo root with --env-file .env.
- Repo root now holds only README.md; CHANGELOG / CONTRIBUTING / SECURITY /
CODE_OF_CONDUCT moved under docs/.
Upgrade notes: docs/upgrading.md#v110--docker-layout. Full log: docs/CHANGELOG.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JKT9p3bfP8RZesExdYCS52
133 lines
5.0 KiB
Bash
133 lines
5.0 KiB
Bash
# =============================================================================
|
|
# ADconsole - example environment file
|
|
#
|
|
# Copy to .env and fill in the values for your environment:
|
|
# cp .env.example .env && php artisan key:generate
|
|
#
|
|
# .env is git-ignored - never commit real hosts, service-account DNs or
|
|
# passwords. Every value below is a placeholder.
|
|
# =============================================================================
|
|
|
|
# --- Application -------------------------------------------------------------
|
|
APP_NAME="ADconsole"
|
|
# Use "local" only on a developer machine (enables verbose errors / debugbar).
|
|
APP_ENV=production
|
|
APP_KEY=
|
|
APP_DEBUG=false
|
|
# Public URL the panel is served from (used for absolute links and cookies).
|
|
APP_URL=https://adconsole.example.com
|
|
|
|
# Hostname Traefik routes to the container (docker/compose.yaml). Ignored on a
|
|
# bare-metal install.
|
|
APP_DOMAIN=adconsole.example.com
|
|
|
|
# Docker image for docker/compose.yaml. By default it pulls the release the
|
|
# Gitea workflow published; ADCONSOLE_VERSION pins a tag, ADCONSOLE_IMAGE
|
|
# replaces the whole reference (e.g. a private mirror). Ignored on bare metal
|
|
# and by `docker compose ... up --build` (which rebuilds locally).
|
|
# ADCONSOLE_VERSION=1.1.0
|
|
# ADCONSOLE_IMAGE=gitea.kzbikowski.pl/kzbkowski/adconsole:1.1.0
|
|
|
|
# Interface language: pl | en. FALLBACK is used for missing translation keys.
|
|
APP_LOCALE=pl
|
|
APP_FALLBACK_LOCALE=en
|
|
|
|
PHP_CLI_SERVER_WORKERS=4
|
|
BCRYPT_ROUNDS=12
|
|
|
|
# --- Logging ---------------------------------------------------------------
|
|
LOG_CHANNEL=stack
|
|
LOG_STACK=single
|
|
LOG_DEPRECATIONS_CHANNEL=null
|
|
# debug | info | notice | warning | error ...
|
|
LOG_LEVEL=warning
|
|
|
|
# --- Database -------------------------------------------------------------
|
|
# ADconsole keeps NO Active Directory data in SQL. The database only backs the
|
|
# application layer: sessions, cache, queue and the panel configuration
|
|
# (table `panel_settings`). Any Laravel-supported driver works; MariaDB/MySQL
|
|
# is the default and what docker/compose.yaml provisions.
|
|
DB_CONNECTION=mysql
|
|
DB_HOST=127.0.0.1
|
|
DB_PORT=3306
|
|
DB_DATABASE=adconsole
|
|
DB_USERNAME=adconsole
|
|
DB_PASSWORD=
|
|
|
|
# Only read by docker/compose.yaml when it first initialises the MariaDB
|
|
# data dir (docker/data/db). Changing them later does NOT change an existing
|
|
# database.
|
|
DB_ROOT_PASSWORD=
|
|
|
|
# --- Session / cache / queue --------------------------------------------
|
|
# "file" keeps sessions on local disk (fine for a single node). Use "database"
|
|
# or "redis" when running more than one app container behind a load balancer.
|
|
SESSION_DRIVER=file
|
|
SESSION_LIFETIME=120
|
|
SESSION_ENCRYPT=false
|
|
SESSION_PATH=/
|
|
SESSION_DOMAIN=null
|
|
|
|
CACHE_STORE=database
|
|
QUEUE_CONNECTION=database
|
|
|
|
# --- Active Directory: connection -------------------------------------------
|
|
# Service account used ONLY to read/modify directory objects. Panel admins log
|
|
# in with their own domain account (see AD_LOGIN_GROUP); this account is never
|
|
# used for interactive login.
|
|
LDAP_CONNECTION=default
|
|
LDAP_LOGGING=true
|
|
|
|
# One or more domain controllers (comma-separated, tried in order).
|
|
LDAP_HOSTS=dc01.corp.example.com,dc02.corp.example.com
|
|
LDAP_USERNAME="CN=svc-adconsole,OU=Service Accounts,DC=corp,DC=example,DC=com"
|
|
LDAP_PASSWORD=
|
|
|
|
# 636 = LDAPS, 389 = plain / STARTTLS.
|
|
LDAP_PORT=636
|
|
LDAP_TIMEOUT=5
|
|
|
|
# Transport security. Password reset and every other WRITE to AD REQUIRE an
|
|
# encrypted channel - AD rejects unicodePwd over a clear connection.
|
|
# LDAP_SSL=true -> LDAPS (port 636) [recommended]
|
|
# LDAP_TLS=true -> STARTTLS (port 389)
|
|
LDAP_SSL=true
|
|
LDAP_TLS=false
|
|
# Verify the DC certificate. Set false for a self-signed / internal-CA cert
|
|
# that the app server does not trust.
|
|
LDAP_TLS_VERIFY=false
|
|
|
|
# Base DN for ALL modules. It MUST contain the users, computers AND groups
|
|
# branches - if those OUs are siblings, point this at the domain root, or the
|
|
# computer/group lists and their OU trees come back empty.
|
|
LDAP_BASE_DN="DC=corp,DC=example,DC=com"
|
|
|
|
# --- Active Directory: defaults ------------------------------------------
|
|
# OU new objects are created in when no branch is picked in the UI; also caps
|
|
# the OU tree shown in each module.
|
|
LDAP_DEFAULT_USER_OU="OU=Users,DC=corp,DC=example,DC=com"
|
|
LDAP_DEFAULT_COMPUTER_OU="OU=Computers,DC=corp,DC=example,DC=com"
|
|
LDAP_DEFAULT_GROUPS_OU="OU=Groups,DC=corp,DC=example,DC=com"
|
|
|
|
# Domain name shown in the panel header.
|
|
AD_DOMAIN_LABEL=corp.example.com
|
|
|
|
# --- Active Directory: who may sign in ---------------------------------------
|
|
# Members of this group may log into the panel. Full group DN (recommended) or
|
|
# a bare CN. Nested membership and the primary group are honoured. Empty = no
|
|
# one can log in.
|
|
AD_LOGIN_GROUP="CN=ADconsole Admins,OU=Groups,DC=corp,DC=example,DC=com"
|
|
|
|
# --- Mail (optional) -----------------------------------------------------
|
|
# ADconsole does not send mail out of the box; configure only if you add it.
|
|
MAIL_MAILER=log
|
|
MAIL_HOST=127.0.0.1
|
|
MAIL_PORT=2525
|
|
MAIL_USERNAME=null
|
|
MAIL_PASSWORD=null
|
|
MAIL_FROM_ADDRESS="adconsole@example.com"
|
|
MAIL_FROM_NAME="${APP_NAME}"
|
|
|
|
# --- Front-end build ---------------------------------------------------------
|
|
VITE_APP_NAME="${APP_NAME}"
|