Stargate/config.example.toml at master · Solsynth/Stargate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
siteUrl = "http://localhost:3000"
baseUrl = "http://localhost:5011"

[http]
port = "8080"

[grpc]
port = "9090"
# TLS is on by default (the C# fleet and Blade dial https://_grpc.stargate).
# server.crt/server.key are issued by the DysonNetwork CA (self-signed);
# clients skip CA validation, mirroring the fleet convention.
useTLS = true
certFile = "Keys/server.crt"
keyFile = "Keys/server.key"

[database]
dsn = "host=localhost port=5432 user=postgres dbname=dyson_stargate sslmode=disable"

[redis]
addr = "localhost:6379"
password = ""
db = 0

[nats]
target = "nats://127.0.0.1:4222"
sessionEventsStream = "auth_session_events"
sessionEventsSubject = "auth.session.revoked"
websocketPushStream = "websocket_push"
websocketPushSubject = "websocket.push"

[auth]
issuer = "solar-network"
audiences = ["http://localhost:5071", "https://localhost:7099"]
publicKeyPath = "Keys/PublicKey.pem"
privateKeyPath = "Keys/PrivateKey.pem"
accessTokenLifetime = "5m"
refreshTokenLifetime = "720h"
cookieDomain = "localhost"
cookieSecure = false

[oidcProvider]
issuerUri = "https://nt.solian.app"
publicKeyPath = "Keys/PublicKey.pem"
privateKeyPath = "Keys/PrivateKey.pem"
accessTokenLifetime = "5m"
refreshTokenLifetime = "720h"
authorizationCodeLifetime = "30m"
requireHttpsMetadata = true

[captcha]
provider = "cloudflare"
apiKey = "0x4AAAAAABCDUdOujj4feOb_"
apiSecret = ""
skip = true

[webauthn]
rpId = "localhost"
rpName = "Solar Network"
relatedOrigins = ["http://localhost:3000"]

# Account activation (mirrors Passport's AccountActivation). Entry-test (exam)
# logic stays in Passport: when testsEnabled is true and requiredTestKeys is
# non-empty, contact verification does NOT activate the account here — Passport
# evaluates the attempts and publishes accounts.activated, which Stargate
# consumes. With no required tests (default), a verified contact activates the
# account immediately.
[accountActivation]
testsEnabled = false
requiredTestKeys = []

[geoip]
databasePath = "Keys/GeoLite2-City.mmdb"

# Outbound gRPC targets. develop is REQUIRED for OIDC client lookup
# (authorize/token/device flows) and custom-app checks; without it every
# /api/auth/open/* client lookup fails with "Client not found". The C#
# Padlock wired it unconditionally via the shared _grpc.develop channel —
# mirror that here, e.g. develop = { grpc = "develop:5001" }.
[services]
develop = { grpc = "" }
drive = { grpc = "" }
wallet = { grpc = "" }
pass = { grpc = "" }
blade = { grpc = "" }
ring = { grpc = "" }

[discovery]
# Register with Blade service discovery so Blade's /meta capability
# aggregator and proxy resolve this instance (auth.*, e2ee, permissions,
# admin.*, accounts.*). Mirror the C# Blade:ServiceDiscovery settings.
enabled = false
target = "blade:9090"
registrationToken = ""
service = "stargate"
instanceId = ""
# Defaults mirror the C# fallback: http://{service}:{httpPort} and
# {service}:{grpcPort}; Blade probes {httpEndpoint}/health and fetches
# capabilities from {grpcEndpoint}.
httpEndpoint = ""
grpcEndpoint = ""
leaseSeconds = 30
weight = 1

[oidc]
google = { clientId = "", clientSecret = "" }
apple = { clientId = "dev.solsynth.solian", teamId = "", keyId = "", privateKeyPath = "Keys/Solarpass.p8" }
microsoft = { clientId = "", clientSecret = "", discoveryEndpoint = "" }
steam = { apiKey = "" }
discord = { clientId = "", clientSecret = "" }
github = { clientId = "", clientSecret = "" }
afdian = { clientId = "", clientSecret = "" }