-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
115 lines (99 loc) · 4.81 KB
/
Copy path.env.example
File metadata and controls
115 lines (99 loc) · 4.81 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# ============================================================================
# Opaflix Configuration (v3.1.1)
# ============================================================================
# Copy this file to .env and fill in your values.
#
# Opaflix supports two deployment modes:
# - Single-Tenant: No database required, config from environment variables
# - Multi-Tenant: PostgreSQL database required, config per-team in database
# ============================================================================
# === MODE SELECTION ===
# YES = multi-tenant (requires database, ?tenant= and ?team= params)
# NO = single-tenant (no database, uses environment variables below)
MULTITENANT=NO
# ============================================================================
# SINGLE-TENANT MODE (required when MULTITENANT=NO)
# ============================================================================
# When MULTITENANT=NO, all configuration comes from these environment variables.
# No database is required, and no URL parameters are needed.
# --- Okta Authentication (Required) ---
# Create an Okta OIDC application and fill in these values
OKTA_ISSUER=https://your-tenant.okta.com
OKTA_CLIENT_ID=your-client-id
OKTA_CLIENT_SECRET=your-client-secret
# --- AWS S3 Configuration (Required) ---
# You need EITHER Method 1 (Static Keys) OR Method 2 (Roles Anywhere), not both.
AWS_REGION=us-east-1
AWS_S3_BUCKET=your-bucket
# Optional prefix path in S3 bucket where recordings are stored
# If set, files will be read from: s3://bucket/{prefix}/ssh~... and s3://bucket/{prefix}/rdp~...
# Leave empty to read from bucket root (default)
# AWS_S3_PREFIX=
# --- Method 1: Static Access Keys (Simple) ---
# Use IAM user credentials with S3 read access to your session recordings bucket.
# Best for: development, simple deployments
AWS_ACCESS_KEY_ID=your-access-key
AWS_SECRET_ACCESS_KEY=your-secret-key
# --- Method 2: IAM Roles Anywhere (Recommended for external deployments) ---
# Use X.509 certificates to authenticate - NO static AWS keys needed!
# Best for: Vercel, on-prem, other clouds
#
# Prerequisites (see docs/AWS.md for full setup):
# 1. Create a Trust Anchor in AWS IAM Roles Anywhere
# 2. Create an IAM Role with S3 permissions
# 3. Create a Profile that references your IAM role
# 4. Generate an X.509 certificate from your CA
#
# To use: Comment out Method 1 above and uncomment these:
# AWS_ROLES_ANYWHERE_TRUST_ANCHOR_ARN=arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/abc123
# AWS_ROLES_ANYWHERE_PROFILE_ARN=arn:aws:rolesanywhere:us-east-1:123456789012:profile/def456
# AWS_ROLES_ANYWHERE_ROLE_ARN=arn:aws:iam::123456789012:role/OpaflixS3Access
# AWS_ROLES_ANYWHERE_CERTIFICATE="-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
# AWS_ROLES_ANYWHERE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
#
# Note: For PEM values, use \n for newlines (e.g., "-----BEGIN CERTIFICATE-----\nMIIC...\n-----END CERTIFICATE-----")
# --- OPA Configuration (URL-based) ---
# The tenant URL uniquely identifies the OPA instance.
# Preview status is derived from the URL (oktapreview.com vs okta.com).
#
# Example for production: demo-blue-sky-1234.pam.okta.com
# Example for preview: demo-blue-sky-1234.pam.oktapreview.com
OPA_TENANT_URL=demo-blue-sky-1234.pam.okta.com
OPA_TEAM_NAME=blue-sky
# --- OPA API Configuration (Optional) ---
# For graph visualization and filter prepopulation
# Requires an OPA Service User with appropriate permissions
OPA_API_KEY_ID=
OPA_API_KEY_SECRET=
# ============================================================================
# MULTI-TENANT MODE (required when MULTITENANT=YES)
# ============================================================================
# When MULTITENANT=YES, tenant configurations are stored in the database.
# Use the /config page in the web UI to manage per-team settings.
#
# URL format: https://your-opaflix.com/sessions?tenant=demo-blue-sky-1234.pam.okta.com&team=blue-sky
# --- PostgreSQL Database (Required for multi-tenant) ---
# Supports any PostgreSQL-compatible database (including Neon)
PGHOST=your-neon-host.neon.tech
PGPORT=5432
PGDATABASE=neondb
PGUSER=neondb_owner
PGPASSWORD=your-password
PGSSLMODE=require
# --- Cache Settings (Optional) ---
CONFIG_CACHE_TTL_MINUTES=5
SESSION_INDEX_REFRESH_MINUTES=5
# ============================================================================
# COMMON SETTINGS (always required)
# ============================================================================
# --- Application URL ---
# The base URL where Opaflix is accessible (no trailing slash)
BASE_URI=http://localhost:3000
# --- Session Secret ---
# A secure random string (minimum 32 characters)
# Generate with: openssl rand -base64 32
SESSION_SECRET=your-secure-session-secret-min-32-chars-long
# --- Optional Settings ---
# PORT=3000
# LOG_LEVEL=info
# FILE_SIZE_LIMIT_MB=500