Public Access
89 lines
3.7 KiB
Bash
89 lines
3.7 KiB
Bash
# ---------------------------------------------------------------- basics
|
|
# Only used to name the very first site and to label authenticator app entries.
|
|
# Add further sites, and rename this one, from Admin -> Sites.
|
|
SITE_NAME=Hideaway Visitor Sign In
|
|
TZ=Australia/Melbourne
|
|
PORT=3000
|
|
|
|
# Long random string. Generate one with: openssl rand -hex 32
|
|
# Changing this invalidates admin sessions AND makes stored visitor PINs unreadable.
|
|
APP_SECRET=change-me-to-a-long-random-string
|
|
|
|
# ------------------------------------------------------- admin accounts
|
|
# Used ONCE, to create the first admin account if none exist. After the first
|
|
# sign in you will be asked to set a new password, and further admins are
|
|
# invited from the console.
|
|
ADMIN_BOOTSTRAP_EMAIL=you@example.com
|
|
ADMIN_BOOTSTRAP_PASSWORD=change-me-then-change-again
|
|
|
|
# Restrict admin sign in to one or more email domains. Blank allows any address.
|
|
# ADMIN_ALLOWED_DOMAINS=hideawaygaming.com.au,school.vic.edu.au
|
|
ADMIN_ALLOWED_DOMAINS=
|
|
|
|
# Every admin must enrol an authenticator app at first sign in.
|
|
ADMIN_REQUIRE_2FA=true
|
|
|
|
# --------------------------------------------------------------- kiosk
|
|
# Require a photo before a visitor can complete sign in.
|
|
REQUIRE_PHOTO=true
|
|
# Photos older than this are deleted from disk automatically. 0 disables the sweep.
|
|
PHOTO_RETENTION_DAYS=90
|
|
# Sign out anyone still on site at this local time. Blank turns it off.
|
|
AUTO_SIGNOUT_TIME=18:30
|
|
|
|
# Warn admins this many days before a recurring visitor's WWCC or VIT expires.
|
|
EXPIRY_WARNING_DAYS=28
|
|
|
|
# ---------------------------------------------------------------- https
|
|
# Browsers block the camera on plain http unless the address is localhost, so the
|
|
# kiosk needs https. Leave this on and the container creates its own certificate
|
|
# authority and server certificate at first start, then renews the server
|
|
# certificate on its own before it lapses.
|
|
HTTPS_ENABLED=true
|
|
SECURE_COOKIES=true
|
|
|
|
# Every name and address staff might type. These go into the certificate, so a
|
|
# missing one means a browser warning. Re-issues automatically when this changes.
|
|
HTTPS_HOSTNAMES=visitors.local,192.168.1.50
|
|
|
|
# Ports published on the docker host.
|
|
HOST_PORT=8443
|
|
HOST_HTTP_PORT=8080
|
|
# Must match HOST_PORT: used to build the http -> https redirect.
|
|
HTTPS_PUBLIC_PORT=8443
|
|
# The in-container http helper. 0 turns it off.
|
|
HTTP_REDIRECT_PORT=3001
|
|
|
|
# Where the certificates live. Leave these alone unless you are supplying your own.
|
|
HTTPS_KEY=/data/certs/server.key
|
|
HTTPS_CERT=/data/certs/server.crt
|
|
|
|
# Set TRUST_PROXY=true instead if you terminate TLS at a reverse proxy and turn
|
|
# HTTPS_ENABLED off.
|
|
TRUST_PROXY=false
|
|
|
|
# --------------------------------------------------------- google sheets
|
|
SHEETS_ENABLED=false
|
|
# The long id from the sheet URL: docs.google.com/spreadsheets/d/<THIS PART>/edit
|
|
SHEETS_SPREADSHEET_ID=
|
|
# Append-only history of every sign in and sign out.
|
|
# Rewritten on every change: only the people currently on site. Open this one
|
|
# during an evacuation. Both tabs are created automatically if missing.
|
|
SHEETS_ONSITE_TAB=On site now
|
|
# Point at the mounted service account json...
|
|
GOOGLE_CREDENTIALS_PATH=/secrets/google-service-account.json
|
|
# ...or paste it base64 encoded instead (base64 -w0 key.json). One or the other.
|
|
GOOGLE_CREDENTIALS_B64=
|
|
SHEETS_RETRY_INTERVAL_MS=60000
|
|
|
|
# ------------------------------------------------------------- printing
|
|
# Badges are rendered and printed by the server, so kiosk tablets need no driver.
|
|
# The printer's address is set per site in Admin -> Sites, not here.
|
|
# PRINT_COMMAND=brother_ql
|
|
PRINT_TIMEOUT_MS=15000
|
|
# How long a sign in waits for the badge before falling back to the kiosk browser.
|
|
PRINT_SIGNIN_WAIT_MS=9000
|
|
|
|
# -------------------------------------------------------------- storage
|
|
DATA_DIR=/data
|