-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
143 lines (136 loc) · 7.47 KB
/
Copy path.env.example
File metadata and controls
143 lines (136 loc) · 7.47 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
# Copy this file to .env and edit the values to match your deployment, then
# run ./run.ps1. Every variable maps onto a parameter of bootstrap.ps1,
# quick-start.ps1, copy-claimsets.ps1, or cleanup.ps1.
#
# Passwords (KEYCLOAK_ADMIN_PASSWORD, APP_DB_PASSWORD, POSTGRES_APP_PASSWORD,
# SECURITY_DB_PASSWORD, POSTGRES_SECURITY_PASSWORD) may be left empty: run.ps1
# and cleanup.ps1 prompt for the ones they need, with the input masked. Set
# them here only for unattended runs.
# Identity provider for the machine (service-account) client:
# keycloak | microsoft | auth0 ('entra' is a deprecated alias for microsoft)
# microsoft: the app registration is done in the Microsoft Entra portal (see the
# docs page); bootstrap.ps1 then only seeds the machine user row.
# auth0: the API (identifier = MACHINE_AUDIENCE, RFC 9068 JWT profile --
# legacy-profile tokens carry only azp and need an Admin App build with the azp
# fallback, after v4.0.1 -- and a 'login:app' permission) and the Machine to
# Machine application are created in the Auth0 dashboard; bootstrap.ps1 seeds
# the machine user row and verifies a real client_credentials token's claims.
PROVIDER=keycloak
# --- Keycloak admin API (bootstrap; only used when PROVIDER=keycloak) --------
KEYCLOAK_BASE_URL=http://localhost:8080
KEYCLOAK_ADMIN_USER=admin
KEYCLOAK_ADMIN_PASSWORD=
KEYCLOAK_REALM=edfi
# --- Auth0 (bootstrap + token; only used when PROVIDER=auth0) -----------------
# Tenant issuer URL, e.g. https://your-tenant.us.auth0.com (either slash form).
AUTH0_ISSUER=
# --- Machine (service-account) client -----------------------------------------
# PROVIDER=microsoft: set MACHINE_CLIENT_ID to the Entra Application (client)
# ID GUID (it must equal the token's azp/appid claim).
# PROVIDER=auth0: set it to the Machine to Machine application's Client ID
# (it must equal the token's client_id claim).
MACHINE_CLIENT_ID=edfiadminapp-machine
MACHINE_CLIENT_SECRET=edfi-machine-secret-456
# Must equal the Admin App's AUTH0_CONFIG_SECRET.MACHINE_AUDIENCE.
# PROVIDER=microsoft with v2 tokens: the API app's client-id GUID instead.
# PROVIDER=auth0: also the Auth0 API's Identifier (the token-request audience).
MACHINE_AUDIENCE=edfiadminapp-api
# --- Admin App application database (machine-user seed + cleanup) -------------
# Engine: mssql | pgsql
DB_ENGINE=mssql
DATABASE_NAME=sbaa
# mssql: the dedicated least-privilege app login created by
# windows-install/install-all.ps1 (its -AppDbPassword value); it is db_owner
# on the app database, so 'sa' is deliberately not used. Used when
# DB_ENGINE=mssql; run.ps1 prompts for the password when left empty.
APP_DB_USERNAME=edfi_adminapp
APP_DB_PASSWORD=
# pgsql: app-user password (used when DB_ENGINE=pgsql; prompted when empty)
POSTGRES_APP_PASSWORD=
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_APP_USER=edfiadminapp
# true: run psql inside the edfiadminapp-postgres Docker container
USE_POSTGRES_DOCKER=false
# Username of the machine user seeded in the Admin App database
MACHINE_USERNAME=quick-start-machine
# --- Quick start (Admin App API) -----------------------------------------------
# Default = the Docker deployment's reverse-proxy path. On a
# windows-install/install-all.ps1 deployment the API is its own IIS site:
# use https://localhost:3443/api (the deployed -HttpsApiPort).
API_BASE_URL=https://localhost/adminapp-api/api
# Resolve from your issuer's discovery document; the Docker-stack Keycloak is:
# (Auth0: https://your-tenant.us.auth0.com/oauth/token)
TOKEN_URL=http://localhost:8080/realms/edfi/protocol/openid-connect/token
# Keycloak: login:app. Entra: the resource's .default scope,
# e.g. api://edfiadminapp-api/.default. Auth0: leave the default; the granted
# 'login:app' permission arrives in the token's scope automatically.
OAUTH_SCOPE=login:app
# Token-request audience. Auth0 REQUIRES it for client_credentials; leave empty
# for PROVIDER=auth0 to default to MACHINE_AUDIENCE (Keycloak/Entra: leave
# empty -- the parameter is omitted).
OAUTH_AUDIENCE=
TEAM_NAME=Quick Start
ENVIRONMENT_NAME=Ed-Fi ODS/API v7.3
ENVIRONMENT_LABEL=QuickStart
# The Admin App self-registers client credentials at
# <ADMIN_API_URL>/connect/register when the environment is created — the Admin
# API must have Authentication:AllowRegistration=true while the quick start runs.
ADMIN_API_URL=https://localhost/AdminApi
ODS_API_DISCOVERY_URL=https://localhost/WebApi
TENANT_NAME=default
# Username of the HUMAN bootstrap admin (the Admin App's ADMIN_USERNAME). When
# set, quick-start.ps1 adds them to the team so the Applications/Profiles
# pages work for that account; leave empty to skip.
ADMIN_USERNAME=admin@example.com
# JSON array of ODS instances to attach to the tenant; ids must match real rows
# in EdFi_Admin.dbo.OdsInstances on the target ODS/API.
ODSS_JSON=[{"id":1,"name":"EdFi_Ods_2026","dbName":"EdFi_Ods_2026","allowedEdOrgs":"255901"},{"id":2,"name":"EdFi_Ods_2027","dbName":"EdFi_Ods_2027","allowedEdOrgs":"255902"}]
# true: skip TLS validation (local self-signed certificates)
SKIP_CERTIFICATE_CHECK=true
# --- Claim set copies (EdFi_Security, on the ODS/API side) ---------------------
# The Admin App hides built-in (Ed-Fi preset) claimsets from the application
# dropdown; copy-claimsets.ps1 copies them under a prefix so they can be
# assigned. EdFi_Security is a DIFFERENT database from the Admin App's, so for
# mssql it has its own SECURITY_DB_* login below (the APP_DB_* login has no
# rights there); pgsql uses the POSTGRES_SECURITY_* values below, each falling
# back to the POSTGRES_* app value above when empty.
# false: skip the step entirely.
COPY_CLAIMSETS=true
# Claimsets to copy, semicolon-separated. Blank = every built-in claimset
# (excluding internal-use ones like 'Bootstrap Descriptors and EdOrgs').
CLAIMSET_NAMES=
# Prefix for the copies; quote it to keep the trailing space (default: "AA ")
CLAIMSET_PREFIX=
# Engine hosting EdFi_Security: mssql | pgsql. Blank = same as DB_ENGINE. Set
# it when the ODS/API side runs a different engine than the Admin App database.
SECURITY_DB_ENGINE=mssql
SECURITY_DATABASE_NAME=EdFi_Security
# mssql: server hosting EdFi_Security (defaults to tcp:localhost,1433)
SECURITY_SQL_SERVER=tcp:localhost,1433
# mssql: true = accept the SQL Server certificate without validating it
# (sqlcmd -C). A loopback server is trusted automatically, so set this only to
# reach a REMOTE server whose certificate is self-signed. It disables
# validation, exposing the connection to a machine-in-the-middle: prefer
# installing a trusted certificate on that server. This is the database
# counterpart of SKIP_CERTIFICATE_CHECK, which covers the web calls only.
SQL_TRUST_SERVER_CERTIFICATE=false
# mssql: a login with rights on EdFi_Security. The username is required unless
# SECURITY_USE_INTEGRATED_SECURITY=true; the password is prompted when empty.
SECURITY_DB_USERNAME=
SECURITY_DB_PASSWORD=
# mssql: true = Windows integrated authentication (SECURITY_DB_* not needed)
SECURITY_USE_INTEGRATED_SECURITY=true
# pgsql: EdFi_Security connection when it differs from the Admin App's
# POSTGRES_* values above. Each blank value falls back to the app one
# (POSTGRES_APP_PASSWORD / POSTGRES_HOST / POSTGRES_PORT / POSTGRES_APP_USER);
# the password is prompted when both are empty.
POSTGRES_SECURITY_PASSWORD=
POSTGRES_SECURITY_HOST=localhost
POSTGRES_SECURITY_PORT=5432
POSTGRES_SECURITY_USER=
# pgsql: true = run psql in the SECURITY_POSTGRES_CONTAINER container.
# Blank = follow USE_POSTGRES_DOCKER.
SECURITY_USE_POSTGRES_DOCKER=false
# pgsql in Docker: the ODS stack's admin/security db container
SECURITY_POSTGRES_CONTAINER=ed-fi-db-admin