cgalo5758
0b28a9dc29
- Replace gorilla/csrf with net/http CrossOriginProtection - Require valkey-password and add TLS options for session store - End session at /logout and revoke refresh tokens - Re-derive identity and roles from provider every five minutes - Process each Stripe webhook event in its own Temporal workflow - Give each outbox entry its own workflow with Temporal retries - Guard against stale Stripe events with provider timestamps - Derive transport security from base-url scheme
63 lines
2.8 KiB
YAML
63 lines
2.8 KiB
YAML
# member-console starter configuration (written by `member-console init`).
|
|
#
|
|
# Fill in the values for your deployment, then run `member-console start`.
|
|
# Startup validates this file and reports anything required that is missing or
|
|
# malformed. Any value can also be supplied via an MC_-prefixed environment
|
|
# variable (e.g. MC_DB_DSN) or, for secrets, a "<key>-file" variant that reads the
|
|
# value from a file path.
|
|
|
|
# --- Required ---
|
|
|
|
# Public URL this console is served at (used for OAuth redirect and CSRF origin).
|
|
# The scheme decides transport security: https sets the session cookie's Secure
|
|
# flag and the CSP upgrade-insecure-requests directive; http, for local plain-HTTP
|
|
# work, sets neither.
|
|
base-url: "https://console.example.com"
|
|
port: "8080"
|
|
|
|
# PostgreSQL connection string.
|
|
db-dsn: "postgres://user:password@localhost:5432/member_console?sslmode=disable"
|
|
|
|
# Valkey/Redis address for the server-side session store.
|
|
valkey-addr: "localhost:6379"
|
|
|
|
# Session-store credentials and transport.
|
|
# Sessions are credentials: they carry the person, organization and workspace
|
|
# ids that authorization is decided from, so anyone who can reach this store
|
|
# unauthenticated can read and forge them. A password is REQUIRED; startup
|
|
# fails without one. TLS stays optional because it needs certificates.
|
|
valkey-password: "" # required; or valkey-password-file, never both
|
|
#valkey-username: "" # ACL user, if the store uses one
|
|
#valkey-tls: false # connect over TLS
|
|
#valkey-tls-skip-verify: false # self-signed stores only; disables certificate checks
|
|
|
|
# OIDC identity provider. Point at a dedicated application realm — not an
|
|
# administration realm (e.g. Keycloak's `master`), whose account console is not a
|
|
# supported end-user surface.
|
|
oidc-idp-issuer-url: "https://idp.example.com/realms/your-realm"
|
|
oidc-sp-client-id: "member-console"
|
|
# Client secret for a confidential client; leave empty for a public (PKCE) client.
|
|
oidc-sp-client-secret: ""
|
|
|
|
# Environment label. "development" selects text logs; anything else selects JSON.
|
|
# The session cookie's Secure flag and the CSP upgrade directive follow
|
|
# base-url's scheme above, not this value.
|
|
env: "production"
|
|
|
|
# --- Optional: Temporal (durable workflows). Leave temporal-host empty to disable. ---
|
|
temporal-host: ""
|
|
temporal-namespace: "default"
|
|
# If your Temporal server authenticates via OIDC, set all three together (or none).
|
|
temporal-oauth-token-url: ""
|
|
temporal-oauth-client-id: ""
|
|
temporal-oauth-client-secret: ""
|
|
temporal-oauth-scopes: []
|
|
|
|
# --- Optional ---
|
|
# URL shown to users in error messages for getting help.
|
|
support-url: ""
|
|
|
|
# Integration sections (Stripe, FedWiki, Discourse, ...) follow below when this
|
|
# file is written by `member-console init`: one commented section per installed
|
|
# integration, generated from its declared configuration.
|