-
Notifications
You must be signed in to change notification settings - Fork 5
Expand file tree
/
Copy path.env.sample
More file actions
165 lines (134 loc) · 6.8 KB
/
Copy path.env.sample
File metadata and controls
165 lines (134 loc) · 6.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
# ========================================
# APPLICATION PORT
# ========================================
PORT=3000
# ========================================
# POSTGRESQL DATABASES
# ========================================
# --- Full Connection URLs (Primarily for Prisma Migrations/Studio) ---
# Note: These are NOT directly used by the migration script anymore,
# but are kept for standard Prisma tooling (e.g., migrate, studio).
# The migration script now constructs the URL from the components above.
GROUP_DB_URL="postgresql://postgres:identitypassword@localhost:5432/group"
IDENTITY_DB_URL="postgresql://postgres:identitypassword@localhost:5432/identity"
MEMBER_DB_URL="postgresql://postgres:identitypassword@localhost:5432/member"
# ========================================
# MYSQL LEGACY AUTH DB (Source for Migration)
# ========================================
# Used by the migration script
MYSQL_HOST=127.0.0.1
MYSQL_PORT=3306 # Port exposed on the host by docker-compose
MYSQL_USER=mysql-user # User created in the MySQL container
MYSQL_PASSWORD=mysql-password # Password for MYSQL_USER
MYSQL_DATABASE=authorization_db # DB name inside the MySQL container
MYSQL_ROOT_PASSWORD=mysql-user-root-password # Root password for MySQL container (used for import)
# ========================================
# REDIS CACHE
# ========================================
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
# REDIS_PASSWORD= # Uncomment and set if password protection is enabled
# REDIS_DB=0 # Optional: default Redis DB index
# ========================================
# JWT VALIDATION (Incoming User Requests)
# ========================================
# Validation Mode:
# HS256: Use for local development with tokens generated using AUTH_SECRET.
# RS256: Use for production/staging with tokens from an external IdP (e.g., Auth0) using JWKS.
JWT_VALIDATION_MODE=HS256
# --- HS256 Settings (if JWT_VALIDATION_MODE=HS256) ---
# Used by jwt.strategy.ts and local token generation script
# IMPORTANT: Replace with a strong, unique secret key in your actual .env file if using HS256
AUTH_SECRET="your-local-dev-secret-key-placeholder"
# Optional: Set to match the issuer/audience in your HS256 tokens for stricter validation
JWT_ISSUER_URL="https://api.topcoder-dev.com"
JWT_AUDIENCE="www.example.com"
# --- RS256 Settings (if JWT_VALIDATION_MODE=RS256) ---
# Used by jwt.strategy.ts if mode is RS256
# Ensure this matches the 'iss' claim in the JWTs from your IdP (e.g., Auth0)
# JWT_ISSUER_URL="https://topcoder-dev.auth0.com/"
# Ensure this matches the 'aud' claim (audience) the JWTs are intended for (your API identifier in IdP)
# JWT_AUDIENCE="https://api.topcoder-dev.com/v5"
# JWKS URI from your IdP (often found at ${JWT_ISSUER_URL}.well-known/jwks.json)
# JWT_JWKS_URI="https://topcoder-dev.auth0.com/.well-known/jwks.json"
# ========================================
# M2M AUTHENTICATION (Service-to-Service)
# ========================================
# Used for authenticating outgoing requests (e.g., to Event Bus)
# --- Auth0 Client Credentials Example ---
# Replace with your actual Auth0 Machine-to-Machine application details
AUTH0_URL="https://topcoder-dev.auth0.com/oauth/token" # Your Auth0 domain
AUTH0_AUDIENCE="https://m2m.topcoder-dev.com/" # API Audience for M2M
AUTH0_CLIENT_ID="change-me" # Client ID of M2M App
AUTH0_CLIENT_SECRET="change-me" # Client Secret of M2M App
AUTH0_DOMAIN="topcoder-dev.auth0.com"
AUTH0_NEW_DOMAIN="topcoder-dev.auth0.com"
AUTH0_NEW_CLIENT_ID="change-me"
AUTH0_NEW_CLIENT_SECRET="change-me"
# Optional: URL of proxy server if needed for token fetching
#AUTH0_PROXY_SERVER_URL=
# Optional: Token cache expiry time in minutes (used by M2M client)
TOKEN_CACHE_TIME=1440 # Example: 24 hours
# ========================================
# EVENT BUS SERVICE
# ========================================
BUSAPI_URL="https://api.topcoder-dev.com/v5" # Example URL - REPLACE IF NEEDED
KAFKA_ERROR_TOPIC="common.error.reporting"
# ========================================
# MEMBER SERVICE
# ========================================
MEMBER_API_URL=https://api.topcoder-dev.com/v5/members
# ========================================
# ROLE CONFIGURATION
# ========================================
ADMIN_ROLE_NAME="administrator" # The name of the admin role in the 'identity' Role table
# ========================================
# SLACK
# ========================================
SLACK_BOT_KEY="key"
SLACK_CHANNEL_ID="C04ENKCU4TZ"
# ========================================
# AUTHENTICATION
# ========================================
JWT_SECRET="my-secret"
# Legacy Blowfish Encryption Key (Base64 Encoded - !!! REPLACE WITH ACTUAL KEY FROM OLD SYSTEM !!!)
# Used for compatibility with the old password encoding scheme.
LEGACY_BLOWFISH_KEY=!!!_REPLACE_WITH_BASE64_ENCODED_KEY_!!!
## SENDGRID
SENDGRID_RESEND_ACTIVATION_EMAIL_TEMPLATE_ID="d-73c29be82bfa4d68beea2208b6a3c4b2"
SENDGRID_SELFSERVICE_RESEND_ACTIVATION_EMAIL_TEMPLATE_ID="d-73c29be82bfa4d68beea2208b6a3c4b2"
SENDGRID_TEMPLATE_ID_OTP_CODE="d-2d0ab9f6c9cc4efba50080668a9c35c1"
SENDGRID_WELCOME_EMAIL_TEMPLATE_ID="d-26c8962fb48c42a3997053ebe5954516"
SENDGRID_SELFSERVICE_WELCOME_EMAIL_TEMPLATE_ID="d-26c8962fb48c42a3997053ebe5954516"
SSO_TOKEN_SALT=change-me
AUTH_OTP_DURATION=10
# Self-service primary email changes. Durations are in seconds. The verify URL
# must contain the <emailChangeCode> placeholder so the signed code can be
# inserted into the validation link sent to the proposed new address. The legacy
# <emailChangeToken> placeholder remains supported for existing deployments.
EMAIL_CHANGE_OTP_EXPIRY_SECONDS=600
EMAIL_CHANGE_OTP_RESEND_SECONDS=60
EMAIL_CHANGE_PROOF_EXPIRY_SECONDS=600
EMAIL_CHANGE_VALIDATION_EXPIRY_SECONDS=3600
EMAIL_CHANGE_VERIFY_URL="https://www.topcoder-dev.com/account-settings/email-change/verify?code=<emailChangeCode>"
EMAIL_CHANGE_CANCEL_URL="https://www.topcoder-dev.com/account-settings"
# cookie expiry seconds
COOKIE_EXPIRY_SECONDS=7776000
ZENDESK_SECRET=change-me
ZENDESK_PREFIX=zendesk-idprefix
# used to build AUTH_DOMAIN
AUTH_DOMAIN="topcoder-dev.com"
VALID_ISSUERS='["https://api.topcoder-dev.com","https://topcoder-dev.com","https://auth0.topcoder-dev.com"]'
# Optional: cache time for JWKS keys in tc-core-library-js (e.g., '24h')
# JWT_KEY_CACHE_TIME='24h'
SERVICEACC01_CID="sathyaadminin"
SERVICEACC01_SECRET="sathyaadminin"
SERVICEACC01_UID="100000070"
SERVICEACC02_CID="devadmin1"
SERVICEACC02_SECRET="devadmin1"
SERVICEACC02_UID="100000027"
# Note: Registration default password is no longer configurable; for social/SSO
# registrations without a provided password, a unique 16-character random
# password is generated at registration time.
# Prisma configuration
IDENTITY_SERVICE_PRISMA_TIMEOUT=10000