Public Access
64 lines
2.6 KiB
Bash
64 lines
2.6 KiB
Bash
# ---------------------------------------------------------------- basics
|
|
# Only used to name the very first site and to label authenticator app entries.
|
|
# Add further sites, and rename this one, from Admin -> Sites.
|
|
SITE_NAME=Hideaway Visitor Sign In
|
|
TZ=Australia/Melbourne
|
|
PORT=3000
|
|
# Port published on the docker host.
|
|
HOST_PORT=8088
|
|
|
|
# Long random string. Generate one with: openssl rand -hex 32
|
|
# Changing this invalidates admin sessions AND makes stored visitor PINs unreadable.
|
|
APP_SECRET=change-me-to-a-long-random-string
|
|
|
|
# ------------------------------------------------------- admin accounts
|
|
# Used ONCE, to create the first admin account if none exist. After the first
|
|
# sign in you will be asked to set a new password, and further admins are
|
|
# invited from the console.
|
|
ADMIN_BOOTSTRAP_EMAIL=you@example.com
|
|
ADMIN_BOOTSTRAP_PASSWORD=change-me-then-change-again
|
|
|
|
# Restrict admin sign in to one or more email domains. Blank allows any address.
|
|
# ADMIN_ALLOWED_DOMAINS=hideawaygaming.com.au,school.vic.edu.au
|
|
ADMIN_ALLOWED_DOMAINS=
|
|
|
|
# Every admin must enrol an authenticator app at first sign in.
|
|
ADMIN_REQUIRE_2FA=true
|
|
|
|
# --------------------------------------------------------------- kiosk
|
|
# Require a photo before a visitor can complete sign in.
|
|
REQUIRE_PHOTO=true
|
|
# Photos older than this are deleted from disk automatically. 0 disables the sweep.
|
|
PHOTO_RETENTION_DAYS=90
|
|
# Sign out anyone still on site at this local time. Blank turns it off.
|
|
AUTO_SIGNOUT_TIME=18:30
|
|
|
|
# Warn admins this many days before a recurring visitor's WWCC or VIT expires.
|
|
EXPIRY_WARNING_DAYS=28
|
|
|
|
# ---------------------------------------------------------------- https
|
|
# The browser will not allow camera access over plain http unless the address is
|
|
# localhost. Either terminate TLS at a reverse proxy, or turn this on and run
|
|
# scripts/gen-cert.sh to create a self-signed certificate.
|
|
HTTPS_ENABLED=false
|
|
HTTPS_KEY=/data/certs/server.key
|
|
HTTPS_CERT=/data/certs/server.crt
|
|
|
|
# Set both of these to true when running behind an HTTPS reverse proxy.
|
|
TRUST_PROXY=false
|
|
SECURE_COOKIES=false
|
|
|
|
# --------------------------------------------------------- google sheets
|
|
SHEETS_ENABLED=false
|
|
# The long id from the sheet URL: docs.google.com/spreadsheets/d/<THIS PART>/edit
|
|
SHEETS_SPREADSHEET_ID=
|
|
SHEETS_TAB_NAME=Visitor log
|
|
# Point at the mounted service account json...
|
|
GOOGLE_CREDENTIALS_PATH=/secrets/google-service-account.json
|
|
# ...or paste it base64 encoded instead (base64 -w0 key.json). One or the other.
|
|
GOOGLE_CREDENTIALS_B64=
|
|
SHEETS_RETRY_INTERVAL_MS=60000
|
|
|
|
# -------------------------------------------------------------- storage
|
|
DATA_DIR=/data
|