-
Notifications
You must be signed in to change notification settings - Fork 177
/
Copy pathsetup.yml
146 lines (139 loc) · 8.64 KB
/
setup.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
---
all:
hosts:
vars:
ssh_key: "{{ lookup('file', '~/.ssh/forem.pub') }}"
app_protocol: https://
database_pool_size: 10
force_ssl_in_rails: "true"
lang: en_US.UTF-8
node_env: "{{ forem_environment }}"
rack_env: "{{ forem_environment }}"
rack_timeout_service_timeout: 300
rack_timeout_wait_timeout: 300
rails_env: "{{ forem_environment }}"
rails_log_to_stdout: "true"
rails_serve_static_files: enabled
redis_sessions_url: redis://localhost:6379
redis_sidekiq_url: redis://localhost:6379
redis_url: redis://localhost:6379
session_expiry_seconds: 1209600
web_concurrency: 2
forem_context: selfhost
forem_container_tag: quay.io/forem/forem:latest
children:
forems:
hosts:
forem:
ansible_connection: local
ansible_python_interpreter: /usr/bin/python3 # on macOS, this may need to be /usr/local/bin/python3
# CHANGE_REQUIRED — forem_domain_name: example.com
forem_domain_name: REPLACEME
# CHANGE_REQUIRED — default_email: [email protected]
default_email: REPLACEME
forem_subdomain_name: www # can be subdomain, i.e. "community" in community.mainwebsite.com
forem_server_hostname: host # You may change to something else if you choose (i.e. server, srv, etc)
# CHANGE_OPTIONAL - strict-origin-when-cross-origin enables embedded youtube video playback
referrer_policy: "same-origin"
# referrer_policy: "strict-origin-when-cross-origin"
app_domain: "{{ forem_subdomain_name }}.{{ forem_domain_name }}"
secret_key_base: "{{ vault_secret_key_base }}"
session_key: _FOREMSELFHOST_Session
imgproxy_key: "{{ vault_imgproxy_key }}"
imgproxy_salt: "{{ vault_imgproxy_salt }}"
forem_version: latest
forem_environment: production
dd_api_key: "{{ vault_dd_api_key }}"
honeybadger_api_key: "{{ vault_honeybadger_api_key }}"
honeybadger_js_api_key: "{{ vault_honeybadger_js_api_key }}"
honeycomb_api_key: "{{ vault_honeycomb_api_key }}"
postgres_user: forem_production
postgres_password: "{{ vault_forem_postgres_password }}"
postgres_host: localhost
recaptcha_secret: "{{ vault_recaptcha_secret }}"
recaptcha_site: "{{ vault_recaptcha_site }}"
sendgrid_api_key: "{{ vault_sendgrid_api_key }}"
sendgrid_api_key_id: "{{ vault_sendgrid_api_key_id }}"
slack_channel: "#forem-activity"
slack_webhook_url: "{{ vault_slack_webhook_url }}"
# Required Ansible Vault secret variables
# Use the following example commands below in a terminal to generate the required variables with Ansible Vault encrypt_string
# These commands should be run in the selfhost directory, since the
# ansible.cfg identifies the vault password which will be used to decrypt
# if ansible-vault prompts for a password, something is not right
# See this URL to learn more about ansible-vault:
# https://docs.ansible.com/ansible/latest/user_guide/vault.html#encrypting-individual-variables-with-ansible-vault
# echo -n $(pwgen -1 128)|ansible-vault encrypt_string --stdin-name vault_secret_key_base
# This is an example of an encrypted vault_secret_key_base variable looks like
# vault_secret_key_base: !vault |
# $ANSIBLE_VAULT;1.1;AES256
# 31626639326433353437623836636431303161363438396661636130646434396430633032343264
# 3433343031316634636133636663666130303330636366350a616333366666656633353136363865
# 32333739623836623362343862623963333834656236333433333665666531373534316238633039
# 3136396237363839350a633764313365343033623061316364646135356336373062313433383866
# 62613738336463366639323230626465353630646161323931396333333764633633303532656632
# 33653839363465313863303533613062666364363563353264613439306539366665383462663234
# 62313161333566373962396561376166333766366233396533356539393738623666656635373436
# 36323064393461393836626537366239363433393261383137366664343734663161323162613634
# 35353863356462326435656435373261386230356631396464653937643463323536656538313036
# 346661356161386132643837386161376337
vault_secret_key_base: REPLACEME
# echo -n $(xxd -g 2 -l 64 -p /dev/random | tr -d '\n') | ansible-vault encrypt_string --stdin-name vault_imgproxy_key
# This is an example of an encrypted vault_imgproxy_key variable looks like
# vault_imgproxy_key: !vault |
# $ANSIBLE_VAULT;1.1;AES256
# 35646264656466303662316162353030343266366562633733623133326663656430356138306266
# 6564343661366430383637633433343364363538316633340a336436653162363032646430333861
# 33643061636336613361373430396332663964333230626661336637623336666366623839323564
# 6432363731363339360a383361323863343131323837636633643261383034316534663634613835
# 32316565343937306536343232313530383935386231333830343339653838303533383037616333
# 33613732366236653466373233366234646437353166326164313764626439393165333861653538
# 61343135373966303931656633363331313838653039626264396136623438626261356632356463
# 64643666613930383938373337363238373032323166333730653734353463656139623838313939
# 34626539626339353263376231623731656362636666636435366531346232363836613739386464
# 303435353334366338646161333636643062
vault_imgproxy_key: REPLACEME
# echo -n $(xxd -g 2 -l 64 -p /dev/random | tr -d '\n') | ansible-vault encrypt_string --stdin-name vault_imgproxy_salt
# This is an example of an encrypted vault_imgproxy_salt variable looks like
# vault_imgproxy_salt: !vault |
# $ANSIBLE_VAULT;1.1;AES256
# 32353437333561633733306239333164363165386437313632373761663535373661633261343833
# 3534303539333235643530613530323964373530353437330a656636626432336633636132616430
# 62316331396436626662303134343964366635316435653264386437653238643964363935643637
# 3433623566346265640a343539303166333439626136343336643232643930393261313035313933
# 36353833376139306266623261623561373235633432333462323230623665633562333565323235
# 36366338646134633738323661656530663261336430633235643938383236353832626138356434
# 30663337353235303038336239343934383065613532343137313038643330346436306261666130
# 34323137633531393665343564613131343431373835336436656239313738303033333065623964
# 30643262313833396234623937616632623561656664393739663266313531366332623434336565
# 316634303133623165643138643831373630
vault_imgproxy_salt: REPLACEME
# echo -n $(pwgen -1 128)|ansible-vault encrypt_string --stdin-name vault_forem_postgres_password
# This is an example of an encrypted vault_forem_postgres_password variable looks like
# vault_forem_postgres_password: !vault |
# $ANSIBLE_VAULT;1.1;AES256
# 32316238646635623832303464343262313831326131376662653037633265316166653439346163
# 6231366436316431303164323634663137663866303036390a323736346236633835613962613634
# 64616233353663643832636435396461393962616264623866613031633931396464346238646564
# 3030336139303735640a646133313066383535643763353938663865363361356463623162366234
# 37656661613334376361353331343437636633646331366466646130383731613939616639313638
# 66613131333735383763656335393762346464346234626633313138376439633965363030616337
# 65643663306266623764643732376535336339383334363131636537376531613738653764343865
# 39316264633764383264396530393532333639643062333838373531626263623965366462633534
# 33343834346333393737353432303065386433303065336563393634393065303838313162653035
# 32306565616362346466643366356463656639333162343030323338656532613132303164373134
# 343463383266383361303634356133326431
vault_forem_postgres_password: REPLACEME
# Optional Ansible Vault variables
# echo -n foobarbaz | ansible-vault encrypt_string --stdin-name vault_my_cool_vaulted_var
vault_cloudinary_api_key:
vault_cloudinary_api_secret:
vault_dd_api_key:
vault_honeybadger_api_key:
vault_honeybadger_js_api_key:
vault_honeycomb_api_key:
vault_recaptcha_secret:
vault_recaptcha_site:
vault_sendgrid_api_key:
vault_sendgrid_api_key_id:
vault_slack_webhook_url: