Aleksandr BogomiakovandClaude
4764f3545f
Workspaces, group mappings and sign-in methods now come from a configuration file synchronized at startup; workspaces dropped from it are disabled, never deleted. Instance administrators (a new role) see and help every workspace and may delete disabled ones; workspace administrators and employees are derived from the user's groups at every SSO sign-in or administrator edit, and the employee permission set belongs to the workspace. Self-registration is gone: users come from SSO (only when their groups map) or from the administrator. Break-glass bootstrap accounts get an HMAC-derived hourly password that all replicas agree on. First SSO sign-in links a matching email contact to the user. The demo runs on the same model with a generated per-start password. Co-Authored-By: Claude <noreply@anthropic.com>
28 lines
1.5 KiB
Bash
28 lines
1.5 KiB
Bash
DATABASE_URL=postgresql://meguri:change-me@127.0.0.1:5432/meguri
|
|
MEGURI_BIND=127.0.0.1:3000
|
|
MEGURI_PUBLIC_URL=http://127.0.0.1:3000
|
|
MEGURI_ROLE=all
|
|
# Instance configuration: workspaces, group mappings and sign-in methods. Required to start,
|
|
# except in demo mode (MEGURI_SEED_DEMO=true), which uses a built-in configuration and ignores this.
|
|
# See deploy/instance-config.example.yaml.
|
|
MEGURI_CONFIG_FILE=/etc/meguri/config.yaml
|
|
# Deployment secret of the confidential OIDC client; required when the configuration has an oidc block.
|
|
# MEGURI_OIDC_CLIENT_SECRET=from-your-secret-manager
|
|
# Allows a configuration without workspaces to disable every existing workspace (normally refused).
|
|
# MEGURI_ALLOW_DISABLE_ALL=false
|
|
MEGURI_SEED_DEMO=false
|
|
# Demo only: adds n empty "Sandbox" workspaces for automated browser checks (0-20).
|
|
# MEGURI_DEMO_SANDBOXES=0
|
|
# Optional separately provisioned empty demo database. Protected databases are never reset.
|
|
# MEGURI_DEMO_DATABASE_URL=postgresql://demo:change-me@127.0.0.1:5432/meguri_demo
|
|
MEGURI_DEMO_WORKSPACE_TTL_SECONDS=86400
|
|
MEGURI_DEMO_ACCOUNT_TTL_SECONDS=172800
|
|
MEGURI_DEMO_REQUEST_TTL_SECONDS=7200
|
|
MEGURI_DEMO_EVENT_TTL_SECONDS=21600
|
|
MEGURI_DEMO_PURGE_GRACE_SECONDS=600
|
|
MEGURI_SKIP_MIGRATIONS=false
|
|
RUST_LOG=meguri=info,cot=warn
|
|
# Tenant-specific JSM deployment secrets. Replace UUID_WITHOUT_DASHES with uppercase tenant ID.
|
|
# MEGURI_JSM_UUID_WITHOUT_DASHES_EMAIL=integration@example.com
|
|
# MEGURI_JSM_UUID_WITHOUT_DASHES_TOKEN=from-your-secret-manager
|