Extract API, migrations and portable NAS deployment

2026-09-07 19:34:49 +03:00
commit 673255fa4f
@@ -0,0 +1,39 @@
+# Copy this file to the project root as .env.production on the NAS.
+# Keep the copied file private and never commit it.
+
+# Synology MariaDB 10 package. Confirm its TCP port in the package settings;
+# 3307 is the common Synology default.
+# NAS end of the dedicated Compose bridge. Container localhost is not the NAS.
+# If you change the Compose subnet, update this address and the SQL host grant.
+DB_HOST=172.29.240.1
+DB_PORT=3307
+DB_NAME=model_delivery
+DB_USER=model_app
+DB_PASSWORD=REPLACE_WITH_A_UNIQUE_DATABASE_PASSWORD
+
+# API loopback is shared with the gateway via network_mode: service:gateway.
+# Keep these values; Web Station selects gateway container port 38080.
+API_HOST=127.0.0.1
+API_PORT=3001
+LOG_LEVEL=info
+
+# Replace both origins with the exact HTTPS addresses configured in DSM.
+# The second origin is the LAN-only administration portal.
+COOKIE_SECURE=true
+APP_ORIGINS=https://deliveries.example.com,https://deliveries-admin.example.com
+
+# Generate once and preserve for the life of this database. Losing or changing
+# it makes saved SSO, directory credentials and provider tokens unreadable.
+TOKEN_ENCRYPTION_KEY=REPLACE_WITH_32_RANDOM_BYTES_IN_BASE64
+
+# One-time code used to create the single recovery administrator account.
+LOCAL_ADMIN_SETUP_TOKEN=REPLACE_WITH_A_LONG_RANDOM_SETUP_CODE
+
+# These can remain blank and be entered through the LAN-only /local-admin UI.
+OIDC_ISSUER=
+OIDC_DISCOVERY_URL=
+OIDC_CLIENT_ID=
+OIDC_CLIENT_SECRET=
+OIDC_REDIRECT_URI=https://deliveries.example.com/api/auth/callback
+OIDC_SCOPES=openid groups
+OIDC_ALLOW_HTTP=false