Gabriel Brown
f33da41cc6
A machine's role is now the interview's first question and the one answer Panama records. Servers get the same shell minus the screen: core packages, nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless ports from 80, firewalld, the nginx-bridge network, and a nightly image updater that replaced watchtower for cause. server/containers/ carries junior's 23 compose services -- secrets moved to per-machine .env files that never enter this public repo, every transformed compose proven to render byte-identical to what is live. 'panama server' enables, disables and relinks them; nothing here restarts a running service. 'boot --server' walks a fresh VPS from its root login to a normal install. Five new contracts pin the secrets rule, the catalog's shape, panama-server's behavior, the role plumbing, and the dotfile classification. Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E
143 lines
3.4 KiB
Bash
143 lines
3.4 KiB
Bash
# Keys
|
|
# Required key for platform encryption/decryption ops
|
|
# THIS IS A SAMPLE ENCRYPTION KEY AND SHOULD NEVER BE USED FOR PRODUCTION
|
|
ENCRYPTION_KEY=CHANGE_ME
|
|
|
|
# JWT
|
|
# Required secrets to sign JWT tokens
|
|
# THIS IS A SAMPLE AUTH_SECRET KEY AND SHOULD NEVER BE USED FOR PRODUCTION
|
|
AUTH_SECRET=CHANGE_ME
|
|
|
|
# Postgres creds
|
|
POSTGRES_PASSWORD=CHANGE_ME
|
|
POSTGRES_USER=infisical_user
|
|
POSTGRES_DB=infisical_db
|
|
|
|
# Required
|
|
DB_CONNECTION_URI=CHANGE_ME
|
|
|
|
# Redis
|
|
REDIS_URL=redis://infisical-redis:6379
|
|
|
|
# Website URL
|
|
# Required
|
|
SITE_URL=https://infisical.gbrown.org
|
|
|
|
# Mail/SMTP
|
|
SMTP_HOST=smtp.mail.me.com
|
|
SMTP_PORT=587
|
|
SMTP_FROM_ADDRESS=[email protected]
|
|
SMTP_FROM_NAME=Infisical Admin
|
|
SMTP_USERNAME=CHANGE_ME
|
|
SMTP_PASSWORD=CHANGE_ME
|
|
|
|
# CICD Integration
|
|
CLIENT_ID_GITHUB=
|
|
CLIENT_ID_GITHUB_APP=
|
|
CLIENT_SLUG_GITHUB_APP=
|
|
CLIENT_SECRET_GITHUB=
|
|
CLIENT_SECRET_GITHUB_APP=
|
|
CLIENT_ID_GITLAB=
|
|
CLIENT_SECRET_GITLAB=
|
|
CLIENT_PRIVATE_KEY_GITHUB_APP=
|
|
CLIENT_APP_ID_GITHUB_APP=
|
|
|
|
# Sentry (optional) for monitoring errors
|
|
SENTRY_DSN=
|
|
|
|
# Infisical Cloud-specific configs
|
|
# Ignore - Not applicable for self-hosted version
|
|
POSTHOG_HOST=
|
|
POSTHOG_PROJECT_API_KEY=
|
|
|
|
# SSO-specific variables
|
|
CLIENT_ID_GOOGLE_LOGIN=
|
|
CLIENT_SECRET_GOOGLE_LOGIN=
|
|
|
|
CLIENT_ID_GITHUB_LOGIN=
|
|
CLIENT_SECRET_GITHUB_LOGIN=
|
|
|
|
CLIENT_ID_GITLAB_LOGIN=
|
|
CLIENT_SECRET_GITLAB_LOGIN=
|
|
|
|
CAPTCHA_SECRET=
|
|
|
|
NEXT_PUBLIC_CAPTCHA_SITE_KEY=
|
|
|
|
OTEL_TELEMETRY_COLLECTION_ENABLED=false
|
|
OTEL_EXPORT_TYPE=prometheus
|
|
OTEL_EXPORT_OTLP_ENDPOINT=
|
|
OTEL_OTLP_PUSH_INTERVAL=
|
|
|
|
OTEL_COLLECTOR_BASIC_AUTH_USERNAME=
|
|
OTEL_COLLECTOR_BASIC_AUTH_PASSWORD=
|
|
|
|
PLAIN_API_KEY=
|
|
PLAIN_WISH_LABEL_IDS=
|
|
|
|
SSL_CLIENT_CERTIFICATE_HEADER_KEY=
|
|
|
|
ENABLE_MSSQL_SECRET_ROTATION_ENCRYPT=true
|
|
|
|
# App Connections
|
|
|
|
# aws assume-role connection
|
|
INF_APP_CONNECTION_AWS_ACCESS_KEY_ID=
|
|
INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY=
|
|
|
|
# github oauth connection
|
|
INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_ID=
|
|
INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_SECRET=
|
|
|
|
#github app connection
|
|
INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID=
|
|
INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET=
|
|
INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY=
|
|
INF_APP_CONNECTION_GITHUB_APP_SLUG=
|
|
INF_APP_CONNECTION_GITHUB_APP_ID=
|
|
|
|
#gitlab app connection
|
|
INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID=
|
|
INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET=
|
|
|
|
#github radar app connection
|
|
INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_ID=
|
|
INF_APP_CONNECTION_GITHUB_RADAR_APP_CLIENT_SECRET=
|
|
INF_APP_CONNECTION_GITHUB_RADAR_APP_PRIVATE_KEY=
|
|
INF_APP_CONNECTION_GITHUB_RADAR_APP_SLUG=
|
|
INF_APP_CONNECTION_GITHUB_RADAR_APP_ID=
|
|
INF_APP_CONNECTION_GITHUB_RADAR_APP_WEBHOOK_SECRET=
|
|
|
|
#gcp app connection
|
|
INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL=
|
|
|
|
# azure app connections
|
|
INF_APP_CONNECTION_AZURE_APP_CONFIGURATION_CLIENT_ID=
|
|
INF_APP_CONNECTION_AZURE_APP_CONFIGURATION_CLIENT_SECRET=
|
|
|
|
INF_APP_CONNECTION_AZURE_KEY_VAULT_CLIENT_ID=
|
|
INF_APP_CONNECTION_AZURE_KEY_VAULT_CLIENT_SECRET=
|
|
|
|
INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_ID=
|
|
INF_APP_CONNECTION_AZURE_CLIENT_SECRETS_CLIENT_SECRET=
|
|
|
|
INF_APP_CONNECTION_AZURE_DEVOPS_CLIENT_ID=
|
|
INF_APP_CONNECTION_AZURE_DEVOPS_CLIENT_SECRET=
|
|
|
|
# heroku app connection
|
|
INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID=
|
|
INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET=
|
|
|
|
# datadog
|
|
SHOULD_USE_DATADOG_TRACER=
|
|
DATADOG_PROFILING_ENABLED=
|
|
DATADOG_ENV=
|
|
DATADOG_SERVICE=
|
|
DATADOG_HOSTNAME=
|
|
|
|
# kubernetes
|
|
KUBERNETES_AUTO_FETCH_SERVICE_ACCOUNT_TOKEN=false
|
|
|
|
# ClickHouse (optional) for audit log storage
|
|
# CLICKHOUSE_URL=http://infisical:infisical@clickhouse:8123/infisical
|