rauthy.deploy.cfg

### !!! CAUTION !!!
###
### This config is incomplete and only exists to provide values that will
### most probably be interesting for testing out Rauthy and to make the
### container image start without any configuration at all during evaluation.
###
### You can find a complete example with all existing config values in the book:
### https://sebadob.github.io/rauthy/config/config.html
###
### DO NOT USE THIS FOR PRODUCTION WITHOUT MODIFICATION
###
### Especially the `ENC_KEYS` should never be used in production. These are
### Only hardcoded for demo purposes!

#####################################
############## ACCESS ###############
#####################################

# If the User Registration endpoint should be accessible by anyone. If not, an admin must create each new user.
# (default: false)
OPEN_USER_REG=true

#####################################
############# CLUSTER################
#####################################

# Can be set to 'k8s' to try to split off the node id from the hostname
# when Hiqlite is running as a StatefulSet inside Kubernetes.
# Will be ignored if `HQL_NODE_ID_FROM=k8s`
#HQL_NODE_ID_FROM=k8s

# The node id must exist in the nodes and there must always be
# at least a node with ID 1
HQL_NODE_ID=1

# All cluster member nodes.
# To make setting the env var easy, the values are separated by `\s`
# while nodes are separated by `\n`
# in the following format:
#
# id addr_raft addr_api
# id addr_raft addr_api
# id addr_raft addr_api
#
# 2 nodes must be separated by 2 `\n`
HQL_NODES="
1 localhost:8100 localhost:8200
"

# Secrets for Raft internal authentication as well as for the API.
# These must be at least 16 characters long and you should provide
# different ones for both variables.
HQL_SECRET_RAFT=SuperSecureSecret1337
HQL_SECRET_API=SuperSecureSecret1337

#####################################
############ DATABASE ###############
#####################################

# Connection string to connect to a Postgres database.
# This will be ignore as long as `HIQLITE=true`.
#
# Format: 'postgresql://User:PasswordWithoutSpecialCharacters@localhost:5432/DatabaseName'
#
# NOTE: The password in this case should be alphanumeric.
# Special characters could cause problems in the connection string.
#
# CAUTION: To make the automatic migrations work with Postgres 15+,
# when you do not want to just use the `postgres` user, You need
# to have a user with the same name as the DB / schema. For instance,
# the following would work without granting extra access to the
# `public` schema which is disabled by default since PG15:
# database: rauthy
# user: rauthy
# schema: rauthy with owner rauthy
#
DATABASE_URL=postgresql://rauthy:123SuperSafe@localhost:5432/rauthy

# Hiqlite is the default database for Rauthy.
# You can opt-out and use Postgres instead by setting the proper
# `DATABASE_URL=postgresql://...` by setting `HIQLITE=false`
# default: true
#HIQLITE=true

# If set to `true`, all SQL statements will be logged for debugging
# purposes.
# default: false
#HQL_LOG_STATEMENTS=false

# The password for the Hiqlite dashboard as Argon2ID hash.
# '123SuperMegaSafe' in this example
HQL_PASSWORD_DASHBOARD=JGFyZ29uMmlkJHY9MTkkbT0zMix0PTIscD0xJE9FbFZURnAwU0V0bFJ6ZFBlSEZDT0EkTklCN0txTy8vanB4WFE5bUdCaVM2SlhraEpwaWVYOFRUNW5qdG9wcXkzQQ==

#####################################
############# E-MAIL ################
#####################################

#SMTP_USERNAME=
#SMTP_PASSWORD=
#SMTP_URL=smtp.change.me
# Format: "Rauthy <rauthy@localhost.de>"
SMTP_FROM="Rauthy <rauthy@localhost.de>"

#####################################
###### ENCRYPTION / HASHING #########
#####################################

# You need to define at least one valid encryption key.
# These keys are used in various places, like for instance
# encrypting confidential client secrets in the database, or
# encryption cookies, and so on.
#
# The format must match:
# ENC_KEYS="
# q6u26onRvXVG4427/M0NFQzhSSldCY01rckJNa1JYZ3g2NUFtSnNOVGdoU0E=
# bVCyTsGaggVy5yqQ/UzluN29DZW41M3hTSkx6Y3NtZmRuQkR2TnJxUTYzcjQ=
# "
#
# The first part until the first `/` is the key ID.
# The ID must match '[a-zA-Z0-9]{2,20}'
#
# The key itself begins after the first `/` has been found.
# The key must be exactly 32 bytes long, encoded as base64.
#
# You can find a more detailed explanation on how to generate
# keys in the documentation:
# 1. https://sebadob.github.io/rauthy/getting_started/k8s.html#create-and-apply-secrets
# 2. https://sebadob.github.io/rauthy/config/encryption.html
#
# You can provide multiple keys to make things like key
# rotation work. Be careful with removing old keys. Make sure
# that all secrets have been migrated beforehand.
# You can find a utility in the Admin UI to do this for you.
#
ENC_KEYS="
q6u26onRvXVG4427/M0NFQzhSSldCY01rckJNa1JYZ3g2NUFtSnNOVGdoU0E=
bVCyTsGaggVy5yqQ/UzluN29DZW41M3hTSkx6Y3NtZmRuQkR2TnJxUTYzcjQ=
"

# This identifies the key ID from the `ENC_KEYS` list, that
# should actively be used for new encryptions.
ENC_KEY_ACTIVE=bVCyTsGaggVy5yqQ

# M_COST should never be below 32768 in production
#ARGON2_M_COST=131072
# T_COST should never be below 1 in production
#ARGON2_T_COST=4
# P_COST should never be below 2 in production
#ARGON2_P_COST=8

# Limits the maximum amount of parallel password hashes at the exact same time to never exceed system memory while
# still allowing a good amount of memory for the argon2id algorithm (default: 2)
# CAUTION: You must make sure, that you have at least (MAX_HASH_THREADS * ARGON2_M_COST / 1024) + idle memory
# of your deployment  available.
MAX_HASH_THREADS=1

#####################################
######### EVENTS / AUDIT ############
#####################################

# The E-Mail address event notifications should be sent to
#EVENT_EMAIL=admin@localhost.de

# The notification level for events. Works the same way as a logging level. For instance:
# 'notice' means send out a notifications for all events with the info level or higher.
# Possible values:
# - info
# - notice
# - warning
# - critical
# default: 'notice'
#EVENT_NOTIFY_LEVEL_EMAIL=notice

# Matrix variables for event notifications.
# `EVENT_MATRIX_USER_ID` and `EVENT_MATRIX_ROOM_ID` are mandatory.
# Depending on your Matrix setup, additionally one of
# `EVENT_MATRIX_ACCESS_TOKEN` or `EVENT_MATRIX_USER_PASSWORD` is needed.
# If you log in to Matrix with User + Password, you may use `EVENT_MATRIX_USER_PASSWORD`.
# If you log in via OIDC SSO (or just want to use a session token you can revoke),
# you should provide `EVENT_MATRIX_ACCESS_TOKEN`.
# If both are given, the `EVENT_MATRIX_ACCESS_TOKEN` will be preferred.
#
# If left empty, no messages will be sent to Slack.
# Format: `@<user_id>:<server address>`
#EVENT_MATRIX_USER_ID=
# Format: `!<random string>:<server address>`
#EVENT_MATRIX_ROOM_ID=
#EVENT_MATRIX_ACCESS_TOKEN=
#EVENT_MATRIX_USER_PASSWORD=
# Optional path to a PEM Root CA certificate file for the Matrix client.
#EVENT_MATRIX_ROOT_CA_PATH=tls/root.cert.pem
# May be set to disable the TLS validation for the Matrix client.
# default: false
#EVENT_MATRIX_DANGER_DISABLE_TLS_VALIDATION=false

# The Webhook for Slack Notifications.
# If left empty, no messages will be sent to Slack.
#EVENT_SLACK_WEBHOOK=

#####################################
############# LOGGING ###############
#####################################

# This is the log level for stdout logs
# Accepts: error, info, debug, trace (default: info)
#LOG_LEVEL=info

# This is a special config which allows the configuration of customized access logs.
# These logs will be logged with each request in addition to the normal LOG_LEVEL logs.
# The following values are valid:
# - Debug
#   CAUTION: The Debug setting logs every information available to the middleware which includes SENSITIVE HEADERS
#   DO NOT use the Debug level in a working production environment!
# - Verbose
#   Verbose logging without headers - generates huge outputs
# - Basic
#   Logs access to all endpoints apart from the Frontend ones which all js, css, ...
# - Modifying
#   Logs only requests to modifying endpoints and skips all GET
# - Off
# default: Modifying
#LOG_LEVEL_ACCESS=Modifying

#####################################
################ MFA ################
#####################################

# If 'true', MFA for an account must be enabled to access the rauthy admin UI (default: true)
ADMIN_FORCE_MFA=false

#####################################
############# SERVER ################
#####################################

# The server address to listen on. Can bind to a specific IP.
# default: 0.0.0.0
#LISTEN_ADDRESS=0.0.0.0

# The listen ports for HTTP / HTTPS, depending on the activated 'LISTEN_SCHEME'
# default: 8080
#LISTEN_PORT_HTTP=8080
# default: 8443
#LISTEN_PORT_HTTPS=8443

# The scheme to use locally, valid values: http | https | http_https | unix_http | unix_https
# For more details about the UNIX domain socket, check out its documentation page.
# default: http_https
LISTEN_SCHEME=http

# The Public URL of the whole deployment
# The LISTEN_SCHEME + PUB_URL must match the HTTP ORIGIN HEADER later on, which is especially important when running
# rauthy behind a reverse proxy. In case of a non-standard port (80/443), you need to add the port to the PUB_URL
PUB_URL=localhost:8080

# default value: number of available physical cores
HTTP_WORKERS=1

# When Rauthy is running behind a reverse proxy, set to true
# default: false
#PROXY_MODE=false

# If the Swagger UI should be served externally as well. This makes the link in the Admin UI work.
#
# CAUTION: The Swagger UI is open and does not require any login to be seen!
# Rauthy is open source, which means anyone could just download it and see on their own,
# but it may be a security concern to just expose less information.
# (default: false)
SWAGGER_UI_EXTERNAL=true

#####################################
############# WEBAUTHN ##############
#####################################

# The 'Relaying Party (RP) ID' - effective domain name (default: localhost)
# CAUTION: When this is changed, no already registered device will work!
#RP_ID=localhost

# Url containing the effective domain name (default: http://localhost:8080)
# CAUTION: Must include the port number!
#RP_ORIGIN=http://localhost:8080

# Non critical RP Name
# Has no security properties and may be changed without issues (default: Rauthy Webauthn)
#RP_NAME='Rauthy Webauthn'

# The Cache lifetime in seconds for Webauthn requests. Within this time, a webauthn request must have been validated.
# (default: 60)
WEBAUTHN_REQ_EXP=60

# The Cache lifetime for additional Webauthn Data like auth codes and so on. Should not be lower than WEBAUTHN_REQ_EXP.
# The value is in seconds (default: 90)
WEBAUTHN_DATA_EXP=90

# With webauthn enabled for a user, he needs to enter username / password on a new system. If these credentials are
# verified, rauthy will set an additional cookie, which will determine how long the user can then use only (safe)
# MFA passwordless webauthn login with yubikeys, apple touch id, windows hello, ... until he needs to verify his
# credentials again.
# Passwordless login is generally much safer than logging in with a password. But sometimes it is possible, that the
# Webauthn devices do not force the user to include a second factor, which in that case would be a single factor login
# again. That is why we should ask for the original password in addition once in a while to set the cookie.
# The value is in hours (default: 2160)
WEBAUTHN_RENEW_EXP=2160

# This feature can be set to 'true' to force User verification during the Webauthn ceremony.
# UV will be true, if the user does not only need to verify its presence by touching the key, but by also providing
# proof that he knows (or is) some secret via a PIN or biometric key for instance.
# With UV, we have a true MFA scenario where UV == false (user presence only) would be a 2FA scenario (with password).
# Be careful with this option, since Android and some special combinations of OS + browser to not support UV yet.
# (default: false)
#WEBAUTHN_FORCE_UV=false

#####################################
############### TLS #################
#####################################

## Rauthy TLS

# Overwrite the path to the TLS certificate file in PEM format for rauthy (default: tls/tls.crt)
TLS_CERT=/app/tls/cert-chain.pem
# Overwrite the path to the TLS private key file in PEM format for rauthy.
# If the path / filename ends with '.der', rauthy will parse it as DER, otherwise as PEM.
# (default: tls/tls.key)
TLS_KEY=/app/tls/key.pem

## CACHE TLS

# If given, these keys / certificates will be used to establish
# TLS connections between nodes.
#HQL_TLS_RAFT_KEY=tls/key.pem
#HQL_TLS_RAFT_CERT=tls/cert-chain.pem
#HQL_TLS_RAFT_DANGER_TLS_NO_VERIFY=true

#HQL_TLS_API_KEY=tls/key.pem
#HQL_TLS_API_CERT=tls/cert-chain.pem
#HQL_TLS_API_DANGER_TLS_NO_VERIFY=true