137 lines
4.8 KiB
Plaintext
137 lines
4.8 KiB
Plaintext
# Django Settings
|
|
DEBUG=False
|
|
SECRET_KEY=change-me-django-secret-key
|
|
ALLOWED_HOSTS=localhost,127.0.0.1,web,nginx
|
|
WEBSOCKET_ALLOW_QUERY_JWT=false
|
|
# Set explicit frontend origins when WebSocket and frontend use different hosts.
|
|
# WEBSOCKET_ALLOWED_ORIGINS=https://app.example.com
|
|
|
|
# Database Settings
|
|
USE_SQLITE=False
|
|
POSTGRES_DB=eusrr
|
|
POSTGRES_USER=eusrr_user
|
|
POSTGRES_PASSWORD=change-me-postgres-password
|
|
DB_HOST=db
|
|
DB_PORT=5432
|
|
|
|
# Redis Settings
|
|
REDIS_HOST=redis
|
|
REDIS_PORT=6379
|
|
CHANNEL_LAYER_CAPACITY=1000
|
|
CHANNEL_LAYER_EXPIRY=60
|
|
CHANNEL_LAYER_GROUP_EXPIRY=86400
|
|
|
|
# Celery Settings
|
|
CELERY_BROKER_URL=redis://redis:6379/0
|
|
CELERY_RESULT_BACKEND=redis://redis:6379/1
|
|
|
|
# Logging
|
|
LOG_FORMAT=json
|
|
LOG_LEVEL=INFO
|
|
# Routine Daphne/Channels access and protocol logs duplicate eusrr lifecycle events.
|
|
DAPHNE_LOG_LEVEL=WARNING
|
|
CHANNELS_SERVER_LOG_LEVEL=WARNING
|
|
# Enable only when every request reaches Django through a trusted proxy that
|
|
# replaces X-Forwarded-For / X-Real-IP (never directly from the internet).
|
|
LOG_TRUST_X_FORWARDED_FOR=false
|
|
|
|
# Ports (for development)
|
|
WEB_PORT=8000
|
|
FRONTEND_PORT=3000
|
|
NGINX_PORT=80
|
|
|
|
# Frontend Settings
|
|
NODE_ENV=production
|
|
|
|
# LDAP / Active Directory (disabled by default)
|
|
LDAP_ENABLED=False
|
|
LDAP_WRITE_ENABLED=False
|
|
# LDAP_URI=ldaps://ad.example.com:636
|
|
# LDAP_BIND_DN=CN=eusrr-service,OU=Service Accounts,DC=example,DC=com
|
|
# LDAP_BIND_PASSWORD=change-me-ldap-password
|
|
# LDAP_CA_CERTS=/etc/ssl/certs/company-ca.pem
|
|
# LDAP_USER_BASE=OU=Users,DC=example,DC=com
|
|
# LDAP_USERS_BASE=OU=Users,DC=example,DC=com
|
|
# LDAP_BASE_DN=OU=Users,DC=example,DC=com
|
|
# LDAP_DEPARTMENTS_BASE=OU=Departments,DC=example,DC=com
|
|
# LDAP_GROUPS_BASE=OU=Groups,DC=example,DC=com
|
|
# LDAP_POSITIONS_BASE=OU=Positions,DC=example,DC=com
|
|
# LDAP_DISMISSED_BASE=OU=Dismissed,DC=example,DC=com
|
|
# LDAP_UPN_SUFFIX=example.com
|
|
# LDAP_EMPLOYEE_ID_ATTR=employeeNumber
|
|
# LDAP_LOGIN_UID_ATTRS=uid,sAMAccountName
|
|
# LDAP_LOGIN_MAIL_ATTRS=mail,userPrincipalName
|
|
|
|
# Email Settings (if used)
|
|
# EMAIL_HOST=smtp.gmail.com
|
|
# EMAIL_PORT=587
|
|
# EMAIL_USE_TLS=True
|
|
# EMAIL_HOST_USER=your-email@example.com
|
|
# EMAIL_HOST_PASSWORD=your-email-password
|
|
|
|
# Other Settings
|
|
SITE_URL=http://localhost:8000
|
|
PORTAL_FRONTEND_URL=http://localhost:3000
|
|
|
|
# Corporate OAuth2 / OpenID Connect provider
|
|
# Generate a dedicated RSA key and mount it outside the repository.
|
|
OIDC_PROVIDER_ENABLED=false
|
|
OIDC_RSA_PRIVATE_KEY_PATH=/run/secrets/eusrr_oidc_private_key.pem
|
|
# Comma-separated old signing keys during a planned rotation.
|
|
# OIDC_RSA_PRIVATE_KEY_PATHS_INACTIVE=/run/secrets/eusrr_oidc_private_key_old.pem
|
|
OIDC_ISSUER_URL=http://localhost:8000/o
|
|
OIDC_PORTAL_LOGIN_URL=http://localhost:3000/login
|
|
OIDC_BROWSER_SESSION_SECONDS=28800
|
|
OIDC_ACCESS_TOKEN_SECONDS=3600
|
|
OIDC_ID_TOKEN_SECONDS=600
|
|
OIDC_REFRESH_TOKEN_SECONDS=43200
|
|
# Only explicitly approved legacy confidential HTTPS clients may omit PKCE.
|
|
# OIDC_LEGACY_NO_PKCE_CLIENT_IDS=gitea
|
|
|
|
# Behind an ingress that overwrites forwarded headers; never expose its app port.
|
|
# TRUST_PROXY_SSL_HEADER=true
|
|
# SECURE_SSL_REDIRECT=true
|
|
# CSRF_COOKIE_SECURE=true
|
|
# SECURE_HSTS_SECONDS=3600
|
|
# LOG_TRUST_X_FORWARDED_FOR=true
|
|
# LOG_TRUSTED_PROXY_CIDRS=127.0.0.1/32,::1/128
|
|
# Enable only after installing the matching internal nginx media locations.
|
|
# DOCUMENTS_USE_X_ACCEL_REDIRECT=true
|
|
# CHAT_ATTACHMENTS_USE_X_ACCEL_REDIRECT=true
|
|
|
|
# Web Push (generate a dedicated VAPID key pair for each environment)
|
|
# VAPID_PUBLIC_KEY=change-me-vapid-public-key
|
|
# VAPID_PRIVATE_KEY=change-me-vapid-private-key
|
|
# VAPID_ADMIN_EMAIL=admin@example.com
|
|
|
|
# LogStorm attendance analyzer
|
|
LOGSTORM_API_URL=http://localhost:8000
|
|
LOGSTORM_API_TOKEN=change-me-logstorm-token
|
|
LOGSTORM_TIMEOUT_SECONDS=30
|
|
|
|
# Finance / Payroll
|
|
# Change RULESET_VERSION whenever calculation semantics change.
|
|
PAYROLL_RULESET_ID=eusrr-standard
|
|
PAYROLL_RULESET_VERSION=2026.07.1
|
|
PAYROLL_EFFECTIVE_FROM=2026-01-01
|
|
# PAYROLL_EFFECTIVE_TO=2026-12-31
|
|
# Keep disabled until the point formula is reconciled against real Excel rows.
|
|
PAYROLL_POINT_POLICY=disabled
|
|
PAYROLL_MONEY_QUANTUM=0.01
|
|
PAYROLL_ROUNDING=half_up
|
|
PAYROLL_ALLOW_NEGATIVE_PAYABLE=false
|
|
PAYROLL_BASE_RATE_CODE=BASE
|
|
# Temporary: staff/superuser receive full payroll access during the pilot.
|
|
PAYROLL_SIMPLE_ADMIN_ACCESS=true
|
|
# Optional Fernet key for encrypted commerce integration credentials.
|
|
# Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
COMMERCE_CREDENTIAL_KEY=
|
|
# A queued import should normally be picked up within seconds. Celery Beat marks
|
|
# lost queue messages as failed after this timeout; running imports use heartbeat.
|
|
COMMERCE_QUEUED_STALE_SECONDS=120
|
|
COMMERCE_RUNNING_STALE_SECONDS=600
|
|
# Long-running imports use task-specific limits instead of the global Celery
|
|
# 25/30 minute limits. The soft limit must remain below the hard limit.
|
|
COMMERCE_TASK_SOFT_TIME_LIMIT=5400
|
|
COMMERCE_TASK_TIME_LIMIT=7200
|