32 lines
932 B
Bash
32 lines
932 B
Bash
APP_MODE=standalone
|
|
LISTEN_ADDR=:8080
|
|
BASE_URL=http://localhost:8080
|
|
DATA_DIR=/data
|
|
STACKS_DIR=/stacks
|
|
AUTH_DISABLED=true
|
|
APP_SECRET=change-me-change-me-change-me-32bytes
|
|
OIDC_ISSUER=
|
|
OIDC_CLIENT_ID=
|
|
OIDC_CLIENT_SECRET=
|
|
OIDC_ADMIN_GROUP=dockwatch-admins
|
|
OIDC_OPERATOR_GROUP=dockwatch-operators
|
|
AGENT_TOKEN=
|
|
CHECK_CONCURRENCY=8
|
|
CHECK_RETENTION_DAYS=30
|
|
HTTP_TIMEOUT_SECONDS=10
|
|
AUDIT_RETENTION_DAYS=180
|
|
|
|
# Optional host/container identity inspection. Mount the target host root at this path.
|
|
# Keep read-only unless you explicitly enable local host account creation.
|
|
HOST_ROOT=
|
|
ALLOW_HOST_USER_MANAGEMENT=false
|
|
ALLOW_HOST_PERMISSION_MANAGEMENT=false
|
|
|
|
# Host Security layer. Audit is separate from mutation/package privileges.
|
|
HOST_SECURITY_ENABLED=false
|
|
ALLOW_HOST_SECURITY_CHANGES=false
|
|
ALLOW_HOST_PACKAGE_MANAGEMENT=false
|
|
# Optional on Arch: non-root account used by paru/yay for AUR updates.
|
|
HOST_AUR_USER=
|
|
HOST_SECURITY_HOST_PID=1
|