mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-02-22 12:29:39 +01:00
75 lines
3.1 KiB
Django/Jinja
75 lines
3.1 KiB
Django/Jinja
# Configuration file for mastodon
|
|
# @see https://docs.joinmastodon.org/admin/config
|
|
# @see https://github.com/mastodon/mastodon/blob/main/.env.production.sample
|
|
|
|
|
|
LOCAL_DOMAIN={{domains[application_id]}}
|
|
ALTERNATE_DOMAINS="{{ domains.mastodon_alternates | join(',') }}"
|
|
SINGLE_USER_MODE={{applications.mastodon.single_user_mode}}
|
|
|
|
# Credentials
|
|
|
|
# Secrets
|
|
# -------
|
|
# Make sure to use `bundle exec rails secret` to generate secrets
|
|
# -------
|
|
SECRET_KEY_BASE= {{applications.mastodon.credentials.secret_key_base}}
|
|
OTP_SECRET= {{applications.mastodon.credentials.otp_secret}}
|
|
|
|
# Web Push
|
|
# --------
|
|
# Generate with `bundle exec rails mastodon:webpush:generate_vapid_key`
|
|
# --------
|
|
VAPID_PRIVATE_KEY= {{applications.mastodon.credentials.vapid.private_key}}
|
|
VAPID_PUBLIC_KEY= {{applications.mastodon.credentials.vapid.public_key}}
|
|
|
|
# Encryption secrets
|
|
# ------------------
|
|
# Must be available (and set to same values) for all server processes
|
|
# These are private/secret values, do not share outside hosting environment
|
|
# Use `bin/rails db:encryption:init` to generate fresh secrets
|
|
# Do NOT change these secrets once in use, as this would cause data loss and other issues
|
|
ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY= {{applications.mastodon.credentials.active_record_encryption.deterministic_key}}
|
|
ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT= {{applications.mastodon.credentials.active_record_encryption.key_derivation_salt}}
|
|
ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY= {{applications.mastodon.credentials.active_record_encryption.primary_key}}
|
|
|
|
DB_HOST={{database_host}}
|
|
DB_PORT={{database_port}}
|
|
DB_NAME={{database_name}}
|
|
DB_USER={{database_username}}
|
|
DB_PASS={{database_password}}
|
|
|
|
REDIS_HOST=redis
|
|
REDIS_PORT=6379
|
|
REDIS_PASSWORD=
|
|
|
|
SMTP_SERVER={{system_email.host}}
|
|
SMTP_PORT={{system_email.port}}
|
|
SMTP_LOGIN={{system_email.username}}
|
|
SMTP_PASSWORD={{system_email.password}}
|
|
SMTP_AUTH_METHOD=plain
|
|
SMTP_OPENSSL_VERIFY_MODE=none
|
|
SMTP_ENABLE_STARTTLS=auto
|
|
SMTP_FROM_ADDRESS=Mastodon <{{system_email.from}}>
|
|
|
|
{% if applications[application_id].oidc.enabled | bool %}
|
|
###################################
|
|
# OpenID Connect settings
|
|
###################################
|
|
# @see https://github.com/mastodon/mastodon/pull/16221
|
|
# @see https://stackoverflow.com/questions/72081776/how-mastodon-configured-login-using-sso
|
|
|
|
OIDC_ENABLED={{ applications[application_id].oidc.enabled | string | lower }}
|
|
OIDC_DISPLAY_NAME="{{primary_domain | upper}} SSO"
|
|
OIDC_ISSUER={{oidc.client.issuer_url}}
|
|
OIDC_DISCOVERY=true
|
|
OIDC_SCOPE="openid,profile,email"
|
|
OIDC_UID_FIELD=preferred_username # @see https://stackoverflow.com/questions/72108087/how-to-set-the-username-of-mastodon-by-log-in-via-keycloak
|
|
OIDC_CLIENT_ID={{oidc.client.id}}
|
|
OIDC_REDIRECT_URI=https://{{domains[application_id]}}/auth/auth/openid_connect/callback
|
|
OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED=true
|
|
OIDC_CLIENT_SECRET={{oidc.client.secret}}
|
|
OMNIAUTH_ONLY=true # uncomment to only use OIDC for login / registration buttons
|
|
ALLOW_UNSAFE_AUTH_PROVIDER_REATTACH=true
|
|
ONE_CLICK_SSO_LOGIN=true
|
|
{% endif %} |