jacobh2
d05f13a080
The server publishes 8080 on the Kvitt Pi's LAN interfaces and trusts X-Forwarded-For only from HA_HOST, NPM's LAN address (an IPv4 literal, checked by install.sh). KVITT_PUBLIC_HOST (owner-chosen, not icehack.asuscomm.com, which is NPM's proxy host for Home Assistant) builds KVITT_PUBLIC_URL. Only fcm-service-account.json and rclone.conf are installed; install.sh removes the Caddyfile, the Home Assistant SSH key, known_hosts and the certs and caddy_data volumes left by the earlier stack. Health checks: port 8080, then through NPM. The cert-sync image leaves the workflow and build-images.sh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
40 lines
2.6 KiB
Bash
40 lines
2.6 KiB
Bash
# Kvitt Pi settings (SPEC §10.2). Copy to .env in this folder, replace every CHANGE_ME, then run ./install.sh,
|
|
# which copies it to /opt/kvitt/.env (mode 0600). install.sh refuses a .env that still contains CHANGE_ME.
|
|
# No secret files here: those go to /opt/kvitt/secrets/ (infra/README.md "Pi: what the owner does").
|
|
|
|
# --- Read by compose.yaml -----------------------------------------------------------------------------------------
|
|
|
|
# Registry and owner path of the Kvitt images; images are ${KVITT_REGISTRY}/kvitt-server|kvitt-backup.
|
|
KVITT_REGISTRY=gitea.lan/jacobh2
|
|
# Image tag to run. deploy.sh sets it; first install: the newest version tag the Gitea workflow pushed (vMAJOR.MINOR.PATCH),
|
|
# or the short git SHA that infra/build-images.sh printed.
|
|
KVITT_TAG=CHANGE_ME_TAG
|
|
# Kvitt's own public host name (D-120), owner-chosen: a domain or DuckDNS name pointing at the home's public address.
|
|
# NPM holds its Let's Encrypt certificate; the router forwards external 8443 to NPM's 443. Invite links and the
|
|
# landing page use https://<KVITT_PUBLIC_HOST>:8443 (KVITT_PUBLIC_URL). Not icehack.asuscomm.com: that name is
|
|
# NPM's proxy host for Home Assistant.
|
|
KVITT_PUBLIC_HOST=CHANGE_ME_KVITT_PUBLIC_HOST
|
|
# LAN IPv4 address of the Home Assistant Pi, where Nginx Proxy Manager terminates TLS and forwards to this Pi's port
|
|
# 8080 (D-120). The server trusts X-Forwarded-For only from this address (KVITT_TRUSTED_PROXY), so it must be the
|
|
# address NPM's connections come from: an IP literal such as 192.168.1.20, not a host name (install.sh checks it).
|
|
# Kept the name HA_HOST (the proxy host); it no longer has the SSH settings HA_PORT, HA_USER, HA_CERT_DIR of cert-sync.
|
|
HA_HOST=CHANGE_ME_HA_HOST
|
|
# rclone remote of the Drive backups, as named in rclone.conf.
|
|
RCLONE_REMOTE=gdrive:
|
|
# Google Drive folder id the backups go to (OQ-4, answered).
|
|
RCLONE_FOLDER_ID=1jDp1dGE5R3H2DBcXCqIPN1iWzQnPkdlV
|
|
|
|
# --- Read by install.sh only (never by the containers) ------------------------------------------------------------
|
|
|
|
# Gitea user that may pull the images; leave empty when the Gitea packages are public (anonymous pull).
|
|
KVITT_REGISTRY_USER=
|
|
# Gitea access token of that user with read:package scope; leave empty for anonymous pull. Never commit a filled .env.
|
|
KVITT_REGISTRY_TOKEN=
|
|
|
|
# --- Informational: used in the owner's commands on the Mac (scp) and in NPM, read by nothing on the Pi ---------
|
|
|
|
# LAN address of the Kvitt Pi itself (OQ-3); also NPM's Forward Hostname / IP (infra/README.md, NPM section).
|
|
KVITT_PI_HOST=CHANGE_ME_KVITT_PI_HOST
|
|
# SSH user on the Kvitt Pi (OQ-3).
|
|
KVITT_PI_SSH_USER=CHANGE_ME_KVITT_PI_SSH_USER
|