6a2f7fec04
All checks were successful
CI / verification (pull_request) Successful in 20s
Both Defenseurs bind mounts are `:ro` since 2026-09-30, set as a suffix on the Coolify destination path; the reports Directory Mount was recreated as a Volume Mount with a Source Path to take it. CLAUDE.md, README.md and .env.example now describe the two layers (mount mode and Unix permissions), the three checks to run after a redeploy, and the Coolify gotchas met on the way. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
28 lines
1.6 KiB
Text
28 lines
1.6 KiB
Text
PORT=3001
|
|
# HEALTH_TOKEN is read at runtime only (process.env at startup).
|
|
# On Coolify: MUST be is_runtime=true, is_buildtime=false.
|
|
# Buildtime ARG leaks the secret in clear in application_deployment_queues.logs.
|
|
HEALTH_TOKEN=change-me-to-a-strong-secret
|
|
LOGTO_HEALTH_URL=https://auth.lacompagniemaximus.com/oidc/.well-known/openid-configuration
|
|
# Directory read by GET /reports/scans and GET /defenseurs/findings. On Coolify
|
|
# it is its own read-only mount (/home/defenseur/defenseurs/reports ->
|
|
# /data/defenseurs/reports:ro), nested inside the read-only /data/defenseurs
|
|
# mount that holds status.json.
|
|
REPORTS_DIR=/data/defenseurs/reports
|
|
|
|
# --- Workstation snapshots (POST /hosts/<id>, GET /hosts) --------------------
|
|
# Directory the API WRITES workstation snapshots into, one <id>.json per host.
|
|
# Unlike the two /data/defenseurs mounts (read-only `:ro`, content owned by
|
|
# uid 1001 in 755/775/664), this one must be writable by uid 1000 (the `node`
|
|
# user the container runs as) or every ingest answers 500.
|
|
HOSTS_DIR=/data/hosts
|
|
# Comma-separated allowlist of host ids. Each entry must match
|
|
# ^[a-z0-9][a-z0-9-]{0,31}$ — anything else is logged and dropped at startup.
|
|
HOSTS_ALLOWED_IDS=thinkpad
|
|
# Bearer token for POST /hosts/<id>. Separate from HEALTH_TOKEN on purpose: a
|
|
# workstation agent should be able to write its own snapshot without gaining
|
|
# read access to the Defenseurs reports. Same Coolify rule as HEALTH_TOKEN —
|
|
# is_runtime=true, is_buildtime=false. Unset -> POST /hosts/<id> answers 503.
|
|
HOSTS_INGEST_TOKEN=change-me-to-a-strong-secret
|
|
# Age (seconds) past which GET /hosts reports a host as offline. Default 900.
|
|
HOSTS_STALE_SECONDS=900
|