342c35f8ce
Removes legacy MongoDB options and code paths from the AOC verification command, enforcing PostgreSQL as the required backend. Updates environment examples and documentation to reflect Valkey and RustFS as defaults, replacing Redis and MinIO references.
77 lines
2.1 KiB
Plaintext
77 lines
2.1 KiB
Plaintext
# Substitutions for docker-compose.prod.yaml
|
|
# ⚠️ Replace all placeholder secrets with values sourced from your secret manager.
|
|
|
|
# PostgreSQL Database
|
|
POSTGRES_USER=stellaops-prod
|
|
POSTGRES_PASSWORD=REPLACE_WITH_STRONG_PASSWORD
|
|
POSTGRES_DB=stellaops_platform
|
|
POSTGRES_PORT=5432
|
|
|
|
# Valkey (Redis-compatible cache and messaging)
|
|
VALKEY_PORT=6379
|
|
|
|
# RustFS Object Storage
|
|
RUSTFS_HTTP_PORT=8080
|
|
|
|
# Authority
|
|
AUTHORITY_ISSUER=https://authority.prod.stella-ops.org
|
|
AUTHORITY_PORT=8440
|
|
|
|
# Signer
|
|
SIGNER_POE_INTROSPECT_URL=https://licensing.prod.stella-ops.org/introspect
|
|
SIGNER_PORT=8441
|
|
|
|
# Attestor
|
|
ATTESTOR_PORT=8442
|
|
|
|
# Issuer Directory
|
|
ISSUER_DIRECTORY_PORT=8447
|
|
ISSUER_DIRECTORY_SEED_CSAF=true
|
|
|
|
# Concelier
|
|
CONCELIER_PORT=8445
|
|
|
|
# Scanner
|
|
SCANNER_WEB_PORT=8444
|
|
SCANNER_QUEUE_BROKER=valkey://valkey:6379
|
|
# `true` enables signed scanner events for Notify ingestion.
|
|
SCANNER_EVENTS_ENABLED=true
|
|
SCANNER_EVENTS_DRIVER=valkey
|
|
SCANNER_EVENTS_DSN=valkey:6379
|
|
SCANNER_EVENTS_STREAM=stella.events
|
|
SCANNER_EVENTS_PUBLISH_TIMEOUT_SECONDS=5
|
|
SCANNER_EVENTS_MAX_STREAM_LENGTH=10000
|
|
|
|
# Scanner Surface.Env Configuration
|
|
SCANNER_SURFACE_FS_ENDPOINT=https://surfacefs.prod.stella-ops.org/api/v1
|
|
SCANNER_SURFACE_CACHE_ROOT=/var/lib/stellaops/surface
|
|
SCANNER_SURFACE_SECRETS_PROVIDER=kubernetes
|
|
SCANNER_SURFACE_SECRETS_ROOT=stellaops/scanner
|
|
|
|
# Zastava (inherits Scanner defaults; override if Observer/Webhook diverge)
|
|
ZASTAVA_SURFACE_FS_ENDPOINT=${SCANNER_SURFACE_FS_ENDPOINT}
|
|
ZASTAVA_SURFACE_CACHE_ROOT=${SCANNER_SURFACE_CACHE_ROOT}
|
|
|
|
# Scheduler (Valkey default, NATS optional)
|
|
SCHEDULER_QUEUE_KIND=Valkey
|
|
SCHEDULER_QUEUE_VALKEY_URL=valkey:6379
|
|
# SCHEDULER_QUEUE_NATS_URL=nats://nats:4222
|
|
SCHEDULER_STORAGE_DATABASE=stellaops_platform
|
|
SCHEDULER_SCANNER_BASEADDRESS=http://scanner-web:8444
|
|
|
|
# NATS (Optional - only if using NATS instead of Valkey for queues)
|
|
NATS_CLIENT_PORT=4222
|
|
|
|
# Advisory AI
|
|
ADVISORY_AI_WEB_PORT=8448
|
|
ADVISORY_AI_SBOM_BASEADDRESS=https://scanner-web:8444
|
|
ADVISORY_AI_INFERENCE_MODE=Local
|
|
ADVISORY_AI_REMOTE_BASEADDRESS=
|
|
ADVISORY_AI_REMOTE_APIKEY=
|
|
|
|
# Web UI
|
|
UI_PORT=8443
|
|
|
|
# External reverse proxy (Traefik, Envoy, etc.) that terminates TLS.
|
|
FRONTDOOR_NETWORK=stellaops_frontdoor
|