mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-08-31 05:07:09 +00:00
281 lines
10 KiB
Bash
281 lines
10 KiB
Bash
# ==============================================================================
|
|
# ATCR Configuration
|
|
# ==============================================================================
|
|
# This file contains ALL configuration options for both AppView and Hold services.
|
|
# Copy to .env and uncomment/modify the values you need.
|
|
#
|
|
# QUICKSTART (minimum for local development):
|
|
# HOLD_PUBLIC_URL=http://127.0.0.1:8080
|
|
# ATCR_DEFAULT_HOLD_DID=did:web:127.0.0.1:8080
|
|
#
|
|
# QUICKSTART (minimum for production):
|
|
# APPVIEW_DOMAIN=atcr.io
|
|
# HOLD_DOMAIN=hold01.atcr.io
|
|
# HOLD_OWNER=did:plc:your-did
|
|
# AWS_ACCESS_KEY_ID=xxx
|
|
# AWS_SECRET_ACCESS_KEY=xxx
|
|
# S3_BUCKET=xxx
|
|
# S3_ENDPOINT=https://xxx
|
|
#
|
|
# ==============================================================================
|
|
|
|
# ==============================================================================
|
|
# DOMAIN CONFIGURATION (Production)
|
|
# ==============================================================================
|
|
# These are used by docker-compose.prod.yml to derive other values automatically.
|
|
# For local dev, skip these and set the explicit URLs below instead.
|
|
|
|
# Main AppView domain (registry API + web UI)
|
|
# APPVIEW_DOMAIN=atcr.io
|
|
|
|
# Hold service domain
|
|
# Used to derive: HOLD_PUBLIC_URL, ATCR_DEFAULT_HOLD_DID
|
|
# HOLD_DOMAIN=hold01.atcr.io
|
|
|
|
# ==============================================================================
|
|
# APPVIEW - SERVER CONFIGURATION
|
|
# ==============================================================================
|
|
|
|
# HTTP listen address
|
|
# Default: :5000
|
|
# ATCR_HTTP_ADDR=:5000
|
|
|
|
# Public URL for OAuth redirect URIs and JWT realms
|
|
# Development: Auto-detected from ATCR_HTTP_ADDR (e.g., http://127.0.0.1:5000)
|
|
# Production: Set to your public URL (e.g., https://atcr.io)
|
|
# ATCR_BASE_URL=https://atcr.io
|
|
|
|
# ==============================================================================
|
|
# APPVIEW - STORAGE CONFIGURATION (REQUIRED)
|
|
# ==============================================================================
|
|
|
|
# Default hold service DID for users without their own storage (REQUIRED)
|
|
# Format: did:web:hostname[:port]
|
|
# Docker dev: did:web:172.28.0.3:8080
|
|
# Local dev: did:web:127.0.0.1:8080
|
|
# Production: did:web:hold01.atcr.io
|
|
ATCR_DEFAULT_HOLD_DID=did:web:127.0.0.1:8080
|
|
|
|
# ==============================================================================
|
|
# APPVIEW - AUTHENTICATION
|
|
# ==============================================================================
|
|
|
|
# Path to JWT signing private key (auto-generated if missing)
|
|
# Default: /var/lib/atcr/auth/private-key.pem
|
|
# ATCR_AUTH_KEY_PATH=/var/lib/atcr/auth/private-key.pem
|
|
|
|
# Path to JWT signing certificate (auto-generated if missing)
|
|
# Default: /var/lib/atcr/auth/private-key.crt
|
|
# ATCR_AUTH_CERT_PATH=/var/lib/atcr/auth/private-key.crt
|
|
|
|
# Path to OAuth client P-256 signing key (auto-generated for production)
|
|
# Used for confidential OAuth client authentication
|
|
# Localhost deployments always use public OAuth clients (no key needed)
|
|
# Default: /var/lib/atcr/oauth/client.key
|
|
# ATCR_OAUTH_KEY_PATH=/var/lib/atcr/oauth/client.key
|
|
|
|
# OAuth client display name (shown in authorization screens)
|
|
# Default: AT Container Registry
|
|
# ATCR_CLIENT_NAME=AT Container Registry
|
|
|
|
# ==============================================================================
|
|
# APPVIEW - WEB UI
|
|
# ==============================================================================
|
|
|
|
# SQLite database path for UI data (sessions, stars, pull counts, etc.)
|
|
# Default: /var/lib/atcr/ui.db
|
|
# ATCR_UI_DATABASE_PATH=/var/lib/atcr/ui.db
|
|
|
|
# ==============================================================================
|
|
# APPVIEW - JETSTREAM (ATProto Event Streaming)
|
|
# ==============================================================================
|
|
|
|
# Jetstream WebSocket URL for real-time ATProto events
|
|
# Default: wss://jetstream2.us-west.bsky.network/subscribe
|
|
# JETSTREAM_URL=wss://jetstream2.us-west.bsky.network/subscribe
|
|
|
|
# Enable backfill worker to sync historical records
|
|
# Default: true
|
|
# ATCR_BACKFILL_ENABLED=true
|
|
|
|
# ATProto relay endpoint for backfill sync API
|
|
# Default: https://relay1.us-east.bsky.network
|
|
# ATCR_RELAY_ENDPOINT=https://relay1.us-east.bsky.network
|
|
|
|
# ==============================================================================
|
|
# APPVIEW - HEALTH CHECKS
|
|
# ==============================================================================
|
|
|
|
# How often to check health of hold endpoints in the background
|
|
# Default: 15m
|
|
# ATCR_HEALTH_CHECK_INTERVAL=15m
|
|
|
|
# How long to cache health check results
|
|
# Default: 15m
|
|
# ATCR_HEALTH_CACHE_TTL=15m
|
|
|
|
# ==============================================================================
|
|
# HOLD SERVICE - SERVER CONFIGURATION (REQUIRED)
|
|
# ==============================================================================
|
|
|
|
# Public URL of hold service (REQUIRED)
|
|
# The hostname becomes the hold name/record key
|
|
# Local dev: http://127.0.0.1:8080
|
|
# Production: https://hold01.atcr.io
|
|
HOLD_PUBLIC_URL=http://127.0.0.1:8080
|
|
|
|
# HTTP listen address
|
|
# Default: :8080
|
|
# HOLD_SERVER_ADDR=:8080
|
|
|
|
# Allow public blob reads (pulls) without authentication
|
|
# Writes (pushes) always require crew membership via PDS
|
|
# Default: false
|
|
# HOLD_PUBLIC=false
|
|
|
|
# ATProto relay endpoint for requesting crawl on startup
|
|
# Makes the hold's embedded PDS discoverable by the relay network
|
|
# Default: (empty - disabled)
|
|
# Set to https://bsky.network to enable
|
|
# HOLD_RELAY_ENDPOINT=https://bsky.network
|
|
|
|
# ==============================================================================
|
|
# HOLD SERVICE - EMBEDDED PDS
|
|
# ==============================================================================
|
|
|
|
# Directory path for embedded PDS carstore (SQLite database)
|
|
# Default: /var/lib/atcr-hold
|
|
# If empty, embedded PDS is disabled
|
|
# Note: This is a directory path, NOT a file path
|
|
# Carstore creates db.sqlite3 inside this directory
|
|
HOLD_DATABASE_DIR=/var/lib/atcr-hold
|
|
|
|
# Path to signing key (auto-generated on first run if missing)
|
|
# Default: {HOLD_DATABASE_DIR}/signing.key
|
|
# HOLD_KEY_PATH=/var/lib/atcr-hold/signing.key
|
|
|
|
# ==============================================================================
|
|
# HOLD SERVICE - REGISTRATION & ACCESS CONTROL
|
|
# ==============================================================================
|
|
|
|
# Your ATProto DID (REQUIRED for registration)
|
|
# Get your DID: https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=yourhandle.bsky.social
|
|
# On first run with HOLD_OWNER set:
|
|
# 1. Hold service prints OAuth URL to logs
|
|
# 2. Visit URL to authorize
|
|
# 3. Hold creates captain + crew records
|
|
# 4. Registration complete!
|
|
# HOLD_OWNER=did:plc:your-did-here
|
|
|
|
# Allow any authenticated user to register as crew
|
|
# Default: false (only explicit crew members can write)
|
|
# Set to true for open/community holds
|
|
# HOLD_ALLOW_ALL_CREW=false
|
|
|
|
# ==============================================================================
|
|
# HOLD SERVICE - BLUESKY INTEGRATION
|
|
# ==============================================================================
|
|
|
|
# Enable Bluesky posts when users push container images
|
|
# When enabled, creates posts announcing image pushes
|
|
# Default: false
|
|
# HOLD_BLUESKY_POSTS_ENABLED=false
|
|
|
|
# Avatar image URL to download during bootstrap
|
|
# HOLD_PROFILE_AVATAR=https://imgs.blue/evan.jarrett.net/1TpTOdtS60GdJWBYEqtK22y688jajbQ9a5kbYRFtwuqrkBAE
|
|
|
|
# ==============================================================================
|
|
# HOLD SERVICE - ADMIN
|
|
# ==============================================================================
|
|
|
|
# Enable admin panel
|
|
# Default: false
|
|
# HOLD_ADMIN_ENABLED=false
|
|
|
|
# ==============================================================================
|
|
# STORAGE - S3 CONFIGURATION
|
|
# ==============================================================================
|
|
|
|
# Storage driver type
|
|
# Options: s3, filesystem
|
|
# Default: s3
|
|
STORAGE_DRIVER=s3
|
|
|
|
# S3 Access Credentials
|
|
AWS_ACCESS_KEY_ID=your_access_key
|
|
AWS_SECRET_ACCESS_KEY=your_secret_key
|
|
|
|
# S3 Region
|
|
# For third-party S3 providers, this is ignored when S3_ENDPOINT is set,
|
|
# but must be a valid AWS region to pass validation.
|
|
# Default: us-east-1
|
|
AWS_REGION=us-east-1
|
|
|
|
# S3 Bucket Name
|
|
S3_BUCKET=atcr-blobs
|
|
|
|
# S3 Endpoint (for S3-compatible services)
|
|
# Examples:
|
|
# - Storj: https://gateway.storjshare.io
|
|
# - UpCloud: https://[bucket-id].upcloudobjects.com
|
|
# - Minio: http://minio:9000
|
|
# Leave empty for AWS S3
|
|
# S3_ENDPOINT=https://gateway.storjshare.io
|
|
|
|
# ==============================================================================
|
|
# STORAGE - FILESYSTEM CONFIGURATION
|
|
# ==============================================================================
|
|
|
|
# Root directory for filesystem storage (when STORAGE_DRIVER=filesystem)
|
|
# Default: /var/lib/atcr/hold
|
|
# STORAGE_ROOT_DIR=/var/lib/atcr/hold
|
|
|
|
# ==============================================================================
|
|
# LOGGING (Shared by AppView and Hold)
|
|
# ==============================================================================
|
|
|
|
# Log level: debug, info, warn, error
|
|
# Default: info
|
|
ATCR_LOG_LEVEL=info
|
|
|
|
# Log formatter: text, json
|
|
# Default: text
|
|
# ATCR_LOG_FORMATTER=text
|
|
|
|
# ==============================================================================
|
|
# REMOTE LOG SHIPPING (Optional)
|
|
# ==============================================================================
|
|
|
|
# Backend: victoria, opensearch, loki (empty = disabled)
|
|
# ATCR_LOG_SHIPPER_BACKEND=victoria
|
|
|
|
# Remote log service URL
|
|
# ATCR_LOG_SHIPPER_URL=http://victorialogs:9428
|
|
|
|
# Number of logs to batch before flushing
|
|
# Default: 100
|
|
# ATCR_LOG_SHIPPER_BATCH_SIZE=100
|
|
|
|
# Max time between flushes
|
|
# Default: 5s
|
|
# ATCR_LOG_SHIPPER_FLUSH_INTERVAL=5s
|
|
|
|
# Basic auth credentials (optional)
|
|
# ATCR_LOG_SHIPPER_USERNAME=
|
|
# ATCR_LOG_SHIPPER_PASSWORD=
|
|
|
|
# ==============================================================================
|
|
# DEVELOPMENT / TESTING
|
|
# ==============================================================================
|
|
|
|
# Enable test mode
|
|
# - Uses HTTP for local DID resolution
|
|
# - Adds transition:generic scope for OAuth
|
|
# - Uses localhost for OAuth redirects while storing real URL in hold record
|
|
# Default: false
|
|
# TEST_MODE=false
|
|
|
|
# Disable presigned URLs (force proxy mode for testing)
|
|
# Default: false
|
|
# DISABLE_PRESIGNED_URLS=false
|