d5398caece
- compose: SSO_ENABLED, SSO_AUTHORITY and the two client credentials, with the undocumented redirect path written down where people will look for it - .env.example: was referenced by the README since episode 1 but never actually committed, so a fresh clone could not follow the quickstart - README: the four steps, plus the debugging notes that cost the most time (no SSO line at startup, 404 on routes without query parameters, HEAD on the discovery endpoint, and the three-step member join) - HARDENING: never copy db.sqlite3 alone while the container runs. WAL mode keeps recent writes in a side file, so that backup silently misses data
48 lines
1.9 KiB
Text
48 lines
1.9 KiB
Text
# ~$ selfhostedops — copy me: cp .env.example .env
|
|
# Generate secrets with: openssl rand -hex 32
|
|
|
|
# Your base domain. Services live at git.* wiki.* vault.* status.* n8n.* vpn.*
|
|
# DNS: one wildcard A (and AAAA) record *.ops.example.com -> your server IP
|
|
DOMAIN=ops.example.com
|
|
|
|
# Let's Encrypt notifications + expiry mails
|
|
ACME_EMAIL=you@example.com
|
|
|
|
TZ=Europe/Berlin
|
|
|
|
# --- Outline ---
|
|
OUTLINE_PG_PASSWORD=CHANGE_ME_openssl_rand_hex_32
|
|
OUTLINE_SECRET_KEY=CHANGE_ME_openssl_rand_hex_32
|
|
OUTLINE_UTILS_SECRET=CHANGE_ME_openssl_rand_hex_32
|
|
# From Forgejo: Site Administration -> Applications -> OAuth2
|
|
# Redirect URI: https://wiki.<DOMAIN>/auth/oidc.callback
|
|
OUTLINE_OIDC_CLIENT_ID=
|
|
OUTLINE_OIDC_CLIENT_SECRET=
|
|
|
|
# --- Vaultwarden ---
|
|
# Admin panel token (argon2 hash recommended, plain string works to start)
|
|
VAULTWARDEN_ADMIN_TOKEN=CHANGE_ME_openssl_rand_hex_32
|
|
# Flip to false once your team has signed up:
|
|
VAULTWARDEN_SIGNUPS_ALLOWED=true
|
|
# Single sign-on against your own Forgejo (episode 4).
|
|
# From Forgejo: Site Administration -> Applications -> OAuth2 Application
|
|
# Redirect URI must be EXACTLY: https://vault.<DOMAIN>/identity/connect/oidc-signin
|
|
VAULTWARDEN_SSO_CLIENT_ID=
|
|
VAULTWARDEN_SSO_CLIENT_SECRET=
|
|
|
|
# --- wg-easy (optional, --profile vpn) ---
|
|
# Generate with: docker run --rm ghcr.io/wg-easy/wg-easy wgpw 'yourpassword'
|
|
WGEASY_PASSWORD_HASH=
|
|
|
|
# --- CI (episode 2, optional: docker compose --profile ci up -d) ---
|
|
# One shared secret registers the runner declaratively. Generate it with:
|
|
# openssl rand -hex 20
|
|
# Then derive the UUID Forgejo will know it by:
|
|
# python3 -c 'import uuid,sys;print(uuid.UUID(bytes=sys.argv[1][:16].encode()))' <secret>
|
|
# And register it on the Forgejo side:
|
|
# docker compose exec -u git forgejo forgejo forgejo-cli actions register \
|
|
# --name box-runner --labels docker --secret <secret>
|
|
# A registration token copied from the web UI does NOT work here.
|
|
RUNNER_SECRET=
|
|
RUNNER_UUID=
|
|
|