isardvdi.cfg.example

# Isard main config v0.1

## Hostname can be whatever you want to identify this host in
## the system paths. If you have a domain set it here
HOSTNAME=localhost

## Frontend Administration Button
## With this variable you can control if there is a button in the simplified
## interface (frontend) to go to administration login for users of role User.
## True: show button
## False (or variable not defined): don't show the button
FRONTEND_SHOW_ADMIN_BTN=True

## Generate your own!:
## openssl rand -base64 32
WEBAPP_SESSION_SECRET=xq0Z3MP5ujxrQxtMGxgPiijH9xpuxkyP04R6At/V+g4=

## Initial WEB admin user password
WEBAPP_ADMIN_PWD=IsardVDI

# WEB CERTIFICATES
## You can use your own certificates if you concatenate into 
## /opt/isard/certs/default/chain.pem
## You can let isard generate autosigned certs (not recommended as
## html5 viewers will not work.
## Or you can let isard generate letsencrypt certs for your domain.
## For this option to work be sure the domain points to this IP.
## To avoid using letsencrypt set it to defaults enpty.
## Note: if this only an hypervisor you should only set VIDEO_LETSENCRYPT
##       variables down this file.
#WEBAPP_LETSENCRYPT_DNS=your.domain.com
#WEBAPP_LETSENCRYPT_EMAIL=info@domain.com
WEBAPP_LETSENCRYPT_DNS=
WEBAPP_LETSENCRYPT_EMAIL=

# GRAFANA
## Set grafana URl to your domain or IP
#GRAFANA_URL=your.domain.com
GRAFANA_URL=localhost

# TELEGRAM BOT ALERTS
## TOKEN: https://core.telegram.org/bots#6-botfather
TELEGRAM_BOT_TOKEN=
## CHAT_ID: Add your bot to a group and get the chat_id from 
## https://api.telegram.org/bot<YourBOTToken>/getUpdates response
TELEGRAM_BOT_CHAT_ID=

##################################################################
##################################################################
## DO NOT EDIT FROM HERE UNLESS YOU KNOW WHAT YOU ARE DOING !!! ##
##################################################################
##################################################################

###################### DOCKER IMAGES

# Image prefix that could include registry and repository
DOCKER_IMAGE_PREFIX=registry.gitlab.com/isard/isardvdi/
# Image tag that could be tags or branches from the git repository
DOCKER_IMAGE_TAG=develop

# Logging level
LOG_LEVEL=INFO

###################### Wireguard

## Users at home will get a unique /32 IP from this range.
## Set a network that will allow as many clients as you will have.
WG_USERS_NET=10.0.0.0/16

## UDP port for users at home to connect wireguard to this server.
WG_USERS_PORT=443

## Only in infrastructure this will be used by remote hypers to 
## send wireguard guests network to the main Isard. 
WG_HYPERS_NET=10.1.0.0/24

## UDP port for remote hypervisors to connect to this server.
WG_HYPERS_PORT=4443

## 0: isard-hypervisor.
## N: next hypers. Be aware not to overlap them!
## You need to set also this number when adding the hypervisor in
## web admin. It should match as the networks are calculated based
## on this hyper number.
HYPERVISOR_NUMBER=0

## This is the main range to be used by wireguard interface in
## guests in your system. Will be subdivided in smaller ranges
## for each hypervisor.
WG_GUESTS_NETS=10.2.0.0/16

## 23: 512 GUESTS -2
## 24: 256 GUESTS -2
## Each hypervisor will get one subnet from WG_GUESTS_NETS
## Last network will be subdivided /29 to connect wireguard hyper
## clients (isard-vpnc) to the wireguard server (isard-vpn)
WG_GUESTS_DHCP_MASK=23
## This sets a reserved dhcp range if you want.
WG_GUESTS_RESERVED_HOSTS=20

## This is the internal interface in wireguard and isard-hypervisor
## containers. In docker it is the isard-vpn network.
WG_INTERFACE=eth1

###################### HYPERVISOR

## Uncomment to map host interface name inside hypervisor container.
## If static vlans are commented then hypervisor will initiate an 
## auto-discovery process. The discovery process will last for 260
## seconds and this will delay the hypervisor from being available.
## So it is recommended to set also the static vlans.
## Note: It will create VlanXXX automatically on webapp. You need to
##       assign who is allowed to use this VlanXXX interfaces.
#HYPERVISOR_HOST_TRUNK_INTERFACE=

## This environment variable depends on previous one. When setting
## vlans number comma separated it will disable auto-discovery and
## fix this as forced vlans inside hypervisor.
#HYPERVISOR_STATIC_VLANS=

###################### Hypervisor video proxy

## Only set this to different LETSENCRYPT domain if you are using
## two different dns for web & hypervisor on the same host and you
## want to use letsencrypt!
## If hypervisor domain is different from web domain then you can use
## your own certificates concatenated in /opt/isard/certs/default/chain.pem
## or set here your hypervisor domain name to let isard generate
## letsencrypt certificate
## Do not set if you don't know what you are doing.
## Default empty
## Set only this environment variables if you are setting an standalone
## hypervisor.
# VIDEO_LETSENCRYPT_DNS=your.video.domain.com
# VIDEO_LETSENCRYPT_EMAIL=info@domain.com
VIDEO_LETSENCRYPT_DNS=
VIDEO_LETSENCRYPT_EMAIL=

###################### ENGINE config

## Main database reacheable host name
## Defaults: isard-db
RETHINKDB_HOST=isard-db
RETHINKDB_PORT=28015
RETHINKDB_DB=isard

###################### WEBAPP config

## Main database reacheable host name
## Defaults: isard-db
## Infrastructure: set it in host /etc/hosts: <IP> isard-db
WEBAPP_HOST=isard-webapp
WEBAPP_RETHINKDB_HOST=isard-db
WEBAPP_RETHINKDB_PORT=28015
WEBAPP_RETHINKDB_DB=isard

###################### BACKEND config

BACKEND_HOST=localhost
BACKEND_REDIS_HOST=isard-redis
BACKEND_REDIS_PASSWORD=
BACKEND_AUTH_AUTOREGISTRATION=true

## Github Login
# Create your Github OAuth credentials at https://github.com/settings/developers
# Homepage URL: https://domain.tld
# Authorization callback URL: https://domain.tld/callback/github
# Change BACKEND_HOST to domain.tld
# BACKEND_AUTH_GITHUB_HOST=api.github.com
# BACKEND_AUTH_GITHUB_ID=id
# BACKEND_AUTH_GITHUB_SECRET=secret

## Google Login
# Create your Google OAUTH credentials at https://console.developers.google.com/apis/credentials
# Authorized redirect URIs: https://domain.tld/callback/google
# Change BACKEND_HOST to domain.tld
# BACKEND_AUTH_GOOGLE_ID=id
# BACKEND_AUTH_GOOGLE_SECRET=secret

# BACKEND_AUTH_SAML_CERT_PATH=/keys/saml.cert
# BACKEND_AUTH_SAML_KEY_PATH=/keys/saml.key
# BACKEND_AUTH_SAML_IDP_URL=https://<yoursamlserver
# BACKEND_AUTH_SAML_IDP_METADATA_PATH=/metadata/shibboleth.xml
# BACKEND_AUTH_SAML_CALLBACK_URL=https://<yourdomain>
# BACKEND_AUTH_SAML_ATTR_ID=uid
# BACKEND_AUTH_SAML_ATTR_NAME=displayName
BACKEND_ISARD_API_HOST=isard-api
BACKEND_MANTEINANCE_ADMINS=admin

# VIDEO config
###########################################################
## Reacheable ip/dns from isard-debug to host holding video haproxy.
## Only to gather statistics 
VIDEO_HAPROXY_HOST=isard-video
VIDEO_PORT=443
VIDEO_STATS_PORT=8889
## Squid video proxy acls
### Comma separated fields of hypervisor hostnames allowed to be proxied.
### Must be the same as the Viewer PROXY name in web ui hypervisor config.
VIDEO_HYPERVISOR_HOSTNAMES=isard-hypervisor
VIDEO_HYPERVISOR_PORTS=5900-6899

# GRAFANA Config
###########################################################
GRAFANA_HOST=isard-grafana
## Path as seen from isard-portal haproxy
GRAFANA_PATH=/monitor/
## Port as defined in isard-portal haproxy
GRAFANA_PORT=443

# STATS host
###########################################################
# This will identify all stats from this host in grafana
STATS_HOSTNAME=localhost
# This must be set to your grafana server hostname
STATS_SERVER=isard-grafana

## Stats database
STATS_RETHINKDB_HOST=isard-db
STATS_RETHINKDB_PORT=28015
STATS_RETHINKDB_DB=isard