Story Crater Bot
674c8f0d66
- PostgreSQL 3-replica HA with pgvector - Vault S3 storage backend (MinIO) - Authentik federated OIDC provider - Vault auto-unseal via postStart hook
28 lines
1.0 KiB
Bash
28 lines
1.0 KiB
Bash
# talos-iam/.env.example
|
|
# Copy to talos-iam/.env and fill in. The real .env is gitignored — never commit it.
|
|
# These are ADMIN credentials for the homelab identity provider; use strong values.
|
|
|
|
# Authentik's signing/encryption key. SET ONCE — rotating it invalidates all
|
|
# existing sessions, tokens, and encrypted fields. Generate:
|
|
# openssl rand -base64 60 | tr -d '\n'
|
|
AUTHENTIK_SECRET_KEY=
|
|
|
|
# Initial password for the built-in admin user 'akadmin'. Change after first login.
|
|
# openssl rand -base64 24
|
|
AUTHENTIK_BOOTSTRAP_PASSWORD=
|
|
|
|
# Initial API token for 'akadmin' (used for automation / blueprints).
|
|
# openssl rand -hex 32
|
|
AUTHENTIK_BOOTSTRAP_TOKEN=
|
|
|
|
# Password for the bundled PostgreSQL 'authentik' user (system of record).
|
|
# openssl rand -base64 24
|
|
PG_PASSWORD=
|
|
|
|
# OAuth2 client secrets for downstream OIDC integrations.
|
|
# These are registered with Authentik and injected as K8s secrets
|
|
# into the logging and storage namespaces by this bootstrap script.
|
|
# openssl rand -hex 32
|
|
GRAFANA_OIDC_CLIENT_SECRET=
|
|
MINIO_OIDC_CLIENT_SECRET=
|