Repository navigation
Expand file tree
/
Copy path.env.example
More file actions
115 lines (94 loc) · 4.87 KB
/
Copy path.env.example
File metadata and controls
115 lines (94 loc) · 4.87 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
# Time zone of the dates the API returns (timeline, failed jobs, audit). Set per deployment.
TZ=Atlantic/Cape_Verde
SERVICE_PROFILE=development
SERVICE_PORT=8080
SERVICE_NAME=process-management-service
LOGGING_LEVEL_ROOT=INFO
LOGGING_LEVEL_SPRING_WEB=DEBUG
LOGGING_LEVEL_APP=DEBUG
POSTGRES_SERVICE_NAME=postgres
POSTGRES_HOST=localhost
POSTGRES_PORT=5432
POSTGRES_DATABASE=db_process_management
POSTGRES_USER=postgres
POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
ENABLE_SWAGGER=true
SPRING_MAIL_HOST=smtp.gmail.com
SPRING_MAIL_PORT=587
SPRING_MAIL_USERNAME=user@gmail.com
SPRING_MAIL_PASSWORD=password
SPRING_MAIL_SMTP_AUTH=true
SPRING_MAIL_SMTP_STARTTLS_ENABLE=true
IGRP_MAIL_DEFAULT_FROM=no-reply@igrp.cv
# Identity recorded on processes started/ended by the system (no user token)
IGRP_PROCESS_SYSTEM_USER_EMAIL=system@irn.mj.pt
AUTH_JWT_ISSUER=https://demoigrp.nosi.cv/auth/realms/igrp
IGRP_ACCESS_API_BASE_URL=https://user-manager-demoigrp.nosi.cv
EUREKA_CLIENT_ENABLED=false
EUREKA_CLIENT_SERVICEURL_DEFAULTZONE=http://igrp-eureka:8761/eureka/
EUREKA_CLIENT_REGISTERWITHEUREKA=true
EUREKA_CLIENT_FETCHREGISTRY=true
SPRING_CLOUD_DISCOVERY_ENABLED=true
SPRING_CLOUD_GATEWAY_DISCOVERY_LOCATOR_ENABLED=true
SPRING_CLOUD_GATEWAY_DISCOVERY_LOCATOR_LOWER_CASE_SERVICE_ID=true
SPRING_KAFKA_BOOTSTRAP_SERVERS=localhost:9092
# Possible values are: kafka|rabbitmq|none
MESSAGE_BROKER_PROVIDER=kafka
# Possible values are: default|irn
# 'igrp' is NOT valid here: process-runtime-auth-igrp is not on this application's classpath, so the
# adapter bean would be missing and startup would fail.
IGRP_AUTHORIZATION_SERVICE_ADAPTER=irn
# Comma-separated browser origins allowed for CORS (with credentials). Empty = no cross-origin
# access at all — the previous wildcard+credentials setup let any site ride the user's session.
IGRP_CORS_ALLOWED_ORIGINS=http://localhost:3000
# Outbound SSRF policy for webhook/assignment delegates. Empty allowed-hosts = any PUBLIC host
# (internal ranges always blocked); set a comma list to restrict further or to allow an internal
# service explicitly. Extra headers lets a process variable set an otherwise-blocked header.
IGRP_OUTBOUND_REQUIRE_HTTPS=true
IGRP_OUTBOUND_ALLOWED_HOSTS=
IGRP_OUTBOUND_ALLOWED_EXTRA_HEADERS=
IGRP_OUTBOUND_MAX_RESPONSE_BYTES=1048576
# Env vars a process may reference via $[VAR] (exact or PREFIX*). Default IGRP_WEBHOOK_* lets webhook
# credentials named by convention resolve while blocking secrets like POSTGRES_PASSWORD. Add any
# other var your process definitions reference (comma-separated).
IGRP_OUTBOUND_ALLOWED_ENV_VARS=IGRP_WEBHOOK_*
# Async service tasks (activiti:async="true", e.g. webhooks): retries when the task sets no
# failedJobRetryTimeCycle. Exhausted jobs are listed and reprocessed in /failed-jobs.
IGRP_ASYNC_JOB_RETRIES=3
IGRP_ASYNC_JOB_RETRY_WAIT=60s
# Reconciliation of tasks between the engine and the app (safety net after background jobs)
IGRP_TASK_RECONCILE_INTERVAL=5m
IGRP_TASK_RECONCILE_GRACE=2m
# Extra IRN permissions accepted on /failed-jobs, per tier (any-of, alongside FAILED_JOBS:<action>)
IRN_FAILED_JOBS_ACCEPT_READ=
IRN_FAILED_JOBS_ACCEPT_DIAGNOSE=
IRN_FAILED_JOBS_ACCEPT_RETRY=
# JWT claim used as the principal name — the identity recorded on tasks, audit columns and logs.
# MUST match the identity format task assignments use. IRN assigns by email, so 'email' is required
# for "my tasks" visibility matching; decide before go-live, never switch with existing data.
IGRP_SECURITY_PRINCIPAL_CLAIM_NAME=email
# IRN identity provider, required when the adapter above is 'irn'
IRN_API_BASE_URL=https://dsv-api-backoffice.irn.lan/exp-cvt-system-administration
IRN_API_SUPER_ADMIN_EMAIL=CHANGE_ME@irn.mj.pt
IRN_API_SESSION_COOKIE_NAME=session_id
# Signed RS256 client used to call the IRN API
IGRP_RESTCLIENT_PROVIDER=irn
IGRP_AUTHORIZATION_JWT_KEY=CHANGE_ME_JWT_KEY
IGRP_AUTHORIZATION_JWT_PRIVATE_KEY=file:/etc/igrp/keys/irn-private-key.pem
# Set to false to fall back to authenticated-only on routes with no rule (not recommended)
IRN_AUTHORIZATION_DENY_UNMATCHED=true
# Observability
# If you need observability, just enable the OpenTelemetry
OTEL_DISABLED=false
OTEL_COLLECTOR_ENDPOINT=http://localhost:4318
# Multi-frontend accept-also (24.5): extra IRN frontend permissions accepted on the tasks routes,
# per tier (any-of, alongside the derived TASK_INSTANCES:<action>). Only TASK_MANAGEMENT:ver is
# confirmed; adjust to the real System Administration verbs.
IRN_TASKS_ACCEPT_READ=FILA_TRABALHO:visualizar,TASK_MANAGEMENT:ver,MY_TASKS:visualizar,AVAILABLE_TASKS:visualizar
IRN_TASKS_ACCEPT_WRITE=
# Permissions that grant "see all tasks" (any-of)
IGRP_TASK_SEARCH_ALL_PERMISSIONS=TASK_INSTANCES:pesquisar_todos
# M2M API keys (24.6, docs/SPEC_M2M_AUTHORIZATION.md). The pepper keys the HMAC of stored key
# hashes — REQUIRED in production; changing it invalidates every existing key.
IGRP_M2M_KEY_PEPPER=CHANGE_ME_STRONG_RANDOM_SECRET
IGRP_M2M_ROTATE_GRACE=7d