diff options
| -rw-r--r-- | README.md | 150 | ||||
| -rw-r--r-- | lib/config/environment.js | 172 | ||||
| -rw-r--r-- | lib/config/hackmdEnvironment.js | 124 | ||||
| -rw-r--r-- | lib/config/index.js | 6 |
4 files changed, 292 insertions, 160 deletions
@@ -165,80 +165,82 @@ There are some config settings you need to change in the files below. | --------- | ------ | ----------- | | `NODE_ENV` | `production` or `development` | set current environment (will apply corresponding settings in the `config.json`) | | `DEBUG` | `true` or `false` | set debug mode; show more logs | -| `HMD_DOMAIN` | `codimd.org` | domain name | -| `HMD_URL_PATH` | `codimd` | sub URL path, like `www.example.com/<URL_PATH>` | -| `HMD_PORT` | `80` | web app port | -| `HMD_ALLOW_ORIGIN` | `localhost, codimd.org` | domain name whitelist (use comma to separate) | -| `HMD_PROTOCOL_USESSL` | `true` or `false` | set to use SSL protocol for resources path (only applied when domain is set) | -| `HMD_URL_ADDPORT` | `true` or `false` | set to add port on callback URL (ports `80` or `443` won't be applied) (only applied when domain is set) | -| `HMD_USECDN` | `true` or `false` | set to use CDN resources or not (default is `true`) | -| `HMD_ALLOW_ANONYMOUS` | `true` or `false` | set to allow anonymous usage (default is `true`) | -| `HMD_ALLOW_ANONYMOUS_EDITS` | `true` or `false` | if `allowAnonymous` is `true`, allow users to select `freely` permission, allowing guests to edit existing notes (default is `false`) | -| `HMD_ALLOW_FREEURL` | `true` or `false` | set to allow new note creation by accessing a nonexistent note URL | -| `HMD_DEFAULT_PERMISSION` | `freely`, `editable`, `limited`, `locked` or `private` | set notes default permission (only applied on signed users) | -| `HMD_DB_URL` | `mysql://localhost:3306/database` | set the database URL | -| `HMD_SESSION_SECRET` | no example | Secret used to sign the session cookie. If non is set, one will randomly generated on startup | -| `HMD_SESSION_LIFE` | `1209600000` | Session life time. (milliseconds) | -| `HMD_FACEBOOK_CLIENTID` | no example | Facebook API client id | -| `HMD_FACEBOOK_CLIENTSECRET` | no example | Facebook API client secret | -| `HMD_TWITTER_CONSUMERKEY` | no example | Twitter API consumer key | -| `HMD_TWITTER_CONSUMERSECRET` | no example | Twitter API consumer secret | -| `HMD_GITHUB_CLIENTID` | no example | GitHub API client id | -| `HMD_GITHUB_CLIENTSECRET` | no example | GitHub API client secret | -| `HMD_GITLAB_SCOPE` | `read_user` or `api` | GitLab API requested scope (default is `api`) (GitLab snippet import/export need `api` scope) | -| `HMD_GITLAB_BASEURL` | no example | GitLab authentication endpoint, set to use other endpoint than GitLab.com (optional) | -| `HMD_GITLAB_CLIENTID` | no example | GitLab API client id | -| `HMD_GITLAB_CLIENTSECRET` | no example | GitLab API client secret | -| `HMD_MATTERMOST_BASEURL` | no example | Mattermost authentication endpoint | -| `HMD_MATTERMOST_CLIENTID` | no example | Mattermost API client id | -| `HMD_MATTERMOST_CLIENTSECRET` | no example | Mattermost API client secret | -| `HMD_DROPBOX_CLIENTID` | no example | Dropbox API client id | -| `HMD_DROPBOX_CLIENTSECRET` | no example | Dropbox API client secret | -| `HMD_GOOGLE_CLIENTID` | no example | Google API client id | -| `HMD_GOOGLE_CLIENTSECRET` | no example | Google API client secret | -| `HMD_LDAP_URL` | `ldap://example.com` | URL of LDAP server | -| `HMD_LDAP_BINDDN` | no example | bindDn for LDAP access | -| `HMD_LDAP_BINDCREDENTIALS` | no example | bindCredentials for LDAP access | -| `HMD_LDAP_SEARCHBASE` | `o=users,dc=example,dc=com` | LDAP directory to begin search from | -| `HMD_LDAP_SEARCHFILTER` | `(uid={{username}})` | LDAP filter to search with | -| `HMD_LDAP_SEARCHATTRIBUTES` | `displayName, mail` | LDAP attributes to search with (use comma to separate) | -| `HMD_LDAP_USERIDFIELD` | `uidNumber` or `uid` or `sAMAccountName` | The LDAP field which is used uniquely identify a user on CodiMD | -| `HMD_LDAP_USERNAMEFIELD` | Fallback to userid | The LDAP field which is used as the username on CodiMD | -| `HMD_LDAP_TLS_CA` | `server-cert.pem, root.pem` | Root CA for LDAP TLS in PEM format (use comma to separate) | -| `HMD_LDAP_PROVIDERNAME` | `My institution` | Optional name to be displayed at login form indicating the LDAP provider | -| `HMD_SAML_IDPSSOURL` | `https://idp.example.com/sso` | authentication endpoint of IdP. for details, see [guide](docs/guides/auth.md#saml-onelogin). | -| `HMD_SAML_IDPCERT` | `/path/to/cert.pem` | certificate file path of IdP in PEM format | -| `HMD_SAML_ISSUER` | no example | identity of the service provider (optional, default: serverurl)" | -| `HMD_SAML_IDENTIFIERFORMAT` | no example | name identifier format (optional, default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`) | -| `HMD_SAML_GROUPATTRIBUTE` | `memberOf` | attribute name for group list (optional) | -| `HMD_SAML_REQUIREDGROUPS` | `Hackmd-users` | group names that allowed (use vertical bar to separate) (optional) | -| `HMD_SAML_EXTERNALGROUPS` | `Temporary-staff` | group names that not allowed (use vertical bar to separate) (optional) | -| `HMD_SAML_ATTRIBUTE_ID` | `sAMAccountName` | attribute map for `id` (optional, default: NameID of SAML response) | -| `HMD_SAML_ATTRIBUTE_USERNAME` | `mailNickname` | attribute map for `username` (optional, default: NameID of SAML response) | -| `HMD_SAML_ATTRIBUTE_EMAIL` | `mail` | attribute map for `email` (optional, default: NameID of SAML response if `HMD_SAML_IDENTIFIERFORMAT` is default) | -| `HMD_IMGUR_CLIENTID` | no example | Imgur API client id | -| `HMD_EMAIL` | `true` or `false` | set to allow email signin | -| `HMD_ALLOW_PDF_EXPORT` | `true` or `false` | Enable or disable PDF exports | -| `HMD_ALLOW_EMAIL_REGISTER` | `true` or `false` | set to allow email register (only applied when email is set, default is `true`. Note `bin/manage_users` might help you if registration is `false`.) | -| `HMD_ALLOW_GRAVATAR` | `true` or `false` | set to `false` to disable gravatar as profile picture source on your instance | -| `HMD_IMAGE_UPLOAD_TYPE` | `imgur`, `s3`, `minio` or `filesystem` | Where to upload images. For S3, see our Image Upload Guides for [S3](docs/guides/s3-image-upload.md) or [Minio](docs/guides/minio-image-upload.md) | -| `HMD_S3_ACCESS_KEY_ID` | no example | AWS access key id | -| `HMD_S3_SECRET_ACCESS_KEY` | no example | AWS secret key | -| `HMD_S3_REGION` | `ap-northeast-1` | AWS S3 region | -| `HMD_S3_BUCKET` | no example | AWS S3 bucket name | -| `HMD_MINIO_ACCESS_KEY` | no example | Minio access key | -| `HMD_MINIO_SECRET_KEY` | no example | Minio secret key | -| `HMD_MINIO_ENDPOINT` | `minio.example.org` | Address of your Minio endpoint/instance | -| `HMD_MINIO_PORT` | `9000` | Port that is used for your Minio instance | -| `HMD_MINIO_SECURE` | `true` | If set to `true` HTTPS is used for Minio | -| `HMD_AZURE_CONNECTION_STRING` | no example | Azure Blob Storage connection string | -| `HMD_AZURE_CONTAINER` | no example | Azure Blob Storage container name (automatically created if non existent) | -| `HMD_HSTS_ENABLE` | ` true` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) | -| `HMD_HSTS_INCLUDE_SUBDOMAINS` | `true` | set to include subdomains in HSTS (default is `true`) | -| `HMD_HSTS_MAX_AGE` | `31536000` | max duration in seconds to tell clients to keep HSTS status (default is a year) | -| `HMD_HSTS_PRELOAD` | `true` | whether to allow preloading of the site's HSTS status (e.g. into browsers) | -| `HMD_CSP_ENABLE` | `true` | whether to enable Content Security Policy (directives cannot be configured with environment variables) | -| `HMD_CSP_REPORTURI` | `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations | +| `CMD_DOMAIN` | `codimd.org` | domain name | +| `CMD_URL_PATH` | `codimd` | sub URL path, like `www.example.com/<URL_PATH>` | +| `CMD_PORT` | `80` | web app port | +| `CMD_ALLOW_ORIGIN` | `localhost, codimd.org` | domain name whitelist (use comma to separate) | +| `CMD_PROTOCOL_USESSL` | `true` or `false` | set to use SSL protocol for resources path (only applied when domain is set) | +| `CMD_URL_ADDPORT` | `true` or `false` | set to add port on callback URL (ports `80` or `443` won't be applied) (only applied when domain is set) | +| `CMD_USECDN` | `true` or `false` | set to use CDN resources or not (default is `true`) | +| `CMD_ALLOW_ANONYMOUS` | `true` or `false` | set to allow anonymous usage (default is `true`) | +| `CMD_ALLOW_ANONYMOUS_EDITS` | `true` or `false` | if `allowAnonymous` is `true`, allow users to select `freely` permission, allowing guests to edit existing notes (default is `false`) | +| `CMD_ALLOW_FREEURL` | `true` or `false` | set to allow new note creation by accessing a nonexistent note URL | +| `CMD_DEFAULT_PERMISSION` | `freely`, `editable`, `limited`, `locked` or `private` | set notes default permission (only applied on signed users) | +| `CMD_DB_URL` | `mysql://localhost:3306/database` | set the database URL | +| `CMD_SESSION_SECRET` | no example | Secret used to sign the session cookie. If non is set, one will randomly generated on startup | +| `CMD_SESSION_LIFE` | `1209600000` | Session life time. (milliseconds) | +| `CMD_FACEBOOK_CLIENTID` | no example | Facebook API client id | +| `CMD_FACEBOOK_CLIENTSECRET` | no example | Facebook API client secret | +| `CMD_TWITTER_CONSUMERKEY` | no example | Twitter API consumer key | +| `CMD_TWITTER_CONSUMERSECRET` | no example | Twitter API consumer secret | +| `CMD_GITHUB_CLIENTID` | no example | GitHub API client id | +| `CMD_GITHUB_CLIENTSECRET` | no example | GitHub API client secret | +| `CMD_GITLAB_SCOPE` | `read_user` or `api` | GitLab API requested scope (default is `api`) (GitLab snippet import/export need `api` scope) | +| `CMD_GITLAB_BASEURL` | no example | GitLab authentication endpoint, set to use other endpoint than GitLab.com (optional) | +| `CMD_GITLAB_CLIENTID` | no example | GitLab API client id | +| `CMD_GITLAB_CLIENTSECRET` | no example | GitLab API client secret | +| `CMD_MATTERMOST_BASEURL` | no example | Mattermost authentication endpoint | +| `CMD_MATTERMOST_CLIENTID` | no example | Mattermost API client id | +| `CMD_MATTERMOST_CLIENTSECRET` | no example | Mattermost API client secret | +| `CMD_DROPBOX_CLIENTID` | no example | Dropbox API client id | +| `CMD_DROPBOX_CLIENTSECRET` | no example | Dropbox API client secret | +| `CMD_GOOGLE_CLIENTID` | no example | Google API client id | +| `CMD_GOOGLE_CLIENTSECRET` | no example | Google API client secret | +| `CMD_LDAP_URL` | `ldap://example.com` | URL of LDAP server | +| `CMD_LDAP_BINDDN` | no example | bindDn for LDAP access | +| `CMD_LDAP_BINDCREDENTIALS` | no example | bindCredentials for LDAP access | +| `CMD_LDAP_SEARCHBASE` | `o=users,dc=example,dc=com` | LDAP directory to begin search from | +| `CMD_LDAP_SEARCHFILTER` | `(uid={{username}})` | LDAP filter to search with | +| `CMD_LDAP_SEARCHATTRIBUTES` | `displayName, mail` | LDAP attributes to search with (use comma to separate) | +| `CMD_LDAP_USERIDFIELD` | `uidNumber` or `uid` or `sAMAccountName` | The LDAP field which is used uniquely identify a user on CodiMD | +| `CMD_LDAP_USERNAMEFIELD` | Fallback to userid | The LDAP field which is used as the username on CodiMD | +| `CMD_LDAP_TLS_CA` | `server-cert.pem, root.pem` | Root CA for LDAP TLS in PEM format (use comma to separate) | +| `CMD_LDAP_PROVIDERNAME` | `My institution` | Optional name to be displayed at login form indicating the LDAP provider | +| `CMD_SAML_IDPSSOURL` | `https://idp.example.com/sso` | authentication endpoint of IdP. for details, see [guide](docs/guides/auth.md#saml-onelogin). | +| `CMD_SAML_IDPCERT` | `/path/to/cert.pem` | certificate file path of IdP in PEM format | +| `CMD_SAML_ISSUER` | no example | identity of the service provider (optional, default: serverurl)" | +| `CMD_SAML_IDENTIFIERFORMAT` | no example | name identifier format (optional, default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`) | +| `CMD_SAML_GROUPATTRIBUTE` | `memberOf` | attribute name for group list (optional) | +| `CMD_SAML_REQUIREDGROUPS` | `Hackmd-users` | group names that allowed (use vertical bar to separate) (optional) | +| `CMD_SAML_EXTERNALGROUPS` | `Temporary-staff` | group names that not allowed (use vertical bar to separate) (optional) | +| `CMD_SAML_ATTRIBUTE_ID` | `sAMAccountName` | attribute map for `id` (optional, default: NameID of SAML response) | +| `CMD_SAML_ATTRIBUTE_USERNAME` | `mailNickname` | attribute map for `username` (optional, default: NameID of SAML response) | +| `CMD_SAML_ATTRIBUTE_EMAIL` | `mail` | attribute map for `email` (optional, default: NameID of SAML response if `CMD_SAML_IDENTIFIERFORMAT` is default) | +| `CMD_IMGUR_CLIENTID` | no example | Imgur API client id | +| `CMD_EMAIL` | `true` or `false` | set to allow email signin | +| `CMD_ALLOW_PDF_EXPORT` | `true` or `false` | Enable or disable PDF exports | +| `CMD_ALLOW_EMAIL_REGISTER` | `true` or `false` | set to allow email register (only applied when email is set, default is `true`. Note `bin/manage_users` might help you if registration is `false`.) | +| `CMD_ALLOW_GRAVATAR` | `true` or `false` | set to `false` to disable gravatar as profile picture source on your instance | +| `CMD_IMAGE_UPLOAD_TYPE` | `imgur`, `s3`, `minio` or `filesystem` | Where to upload images. For S3, see our Image Upload Guides for [S3](docs/guides/s3-image-upload.md) or [Minio](docs/guides/minio-image-upload.md) | +| `CMD_S3_ACCESS_KEY_ID` | no example | AWS access key id | +| `CMD_S3_SECRET_ACCESS_KEY` | no example | AWS secret key | +| `CMD_S3_REGION` | `ap-northeast-1` | AWS S3 region | +| `CMD_S3_BUCKET` | no example | AWS S3 bucket name | +| `CMD_MINIO_ACCESS_KEY` | no example | Minio access key | +| `CMD_MINIO_SECRET_KEY` | no example | Minio secret key | +| `CMD_MINIO_ENDPOINT` | `minio.example.org` | Address of your Minio endpoint/instance | +| `CMD_MINIO_PORT` | `9000` | Port that is used for your Minio instance | +| `CMD_MINIO_SECURE` | `true` | If set to `true` HTTPS is used for Minio | +| `CMD_AZURE_CONNECTION_STRING` | no example | Azure Blob Storage connection string | +| `CMD_AZURE_CONTAINER` | no example | Azure Blob Storage container name (automatically created if non existent) | +| `CMD_HSTS_ENABLE` | ` true` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) | +| `CMD_HSTS_INCLUDE_SUBDOMAINS` | `true` | set to include subdomains in HSTS (default is `true`) | +| `CMD_HSTS_MAX_AGE` | `31536000` | max duration in seconds to tell clients to keep HSTS status (default is a year) | +| `CMD_HSTS_PRELOAD` | `true` | whether to allow preloading of the site's HSTS status (e.g. into browsers) | +| `CMD_CSP_ENABLE` | `true` | whether to enable Content Security Policy (directives cannot be configured with environment variables) | +| `CMD_CSP_REPORTURI` | `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations | + +***Note:** Due to the rename process we renamed all `HMD_`-prefix variables to be `CMD_`-prefixed. The old ones continue to work.* ## Application settings `config.json` diff --git a/lib/config/environment.js b/lib/config/environment.js index 0ca3d920..d850ac9d 100644 --- a/lib/config/environment.js +++ b/lib/config/environment.js @@ -3,123 +3,123 @@ const {toBooleanConfig, toArrayConfig, toIntegerConfig} = require('./utils') module.exports = { - domain: process.env.HMD_DOMAIN, - urlPath: process.env.HMD_URL_PATH, - port: toIntegerConfig(process.env.HMD_PORT), - urlAddPort: toBooleanConfig(process.env.HMD_URL_ADDPORT), - useSSL: toBooleanConfig(process.env.HMD_USESSL), + domain: process.env.CMD_DOMAIN, + urlPath: process.env.CMD_URL_PATH, + port: toIntegerConfig(process.env.CMD_PORT), + urlAddPort: toBooleanConfig(process.env.CMD_URL_ADDPORT), + useSSL: toBooleanConfig(process.env.CMD_USESSL), hsts: { - enable: toBooleanConfig(process.env.HMD_HSTS_ENABLE), - maxAgeSeconds: process.env.HMD_HSTS_MAX_AGE, - includeSubdomains: toBooleanConfig(process.env.HMD_HSTS_INCLUDE_SUBDOMAINS), - preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD) + enable: toBooleanConfig(process.env.CMD_HSTS_ENABLE), + maxAgeSeconds: process.env.CMD_HSTS_MAX_AGE, + includeSubdomains: toBooleanConfig(process.env.CMD_HSTS_INCLUDE_SUBDOMAINS), + preload: toBooleanConfig(process.env.CMD_HSTS_PRELOAD) }, csp: { - enable: toBooleanConfig(process.env.HMD_CSP_ENABLE), - reportURI: process.env.HMD_CSP_REPORTURI - }, - protocolUseSSL: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL), - allowOrigin: toArrayConfig(process.env.HMD_ALLOW_ORIGIN), - useCDN: toBooleanConfig(process.env.HMD_USECDN), - allowAnonymous: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS), - allowAnonymousEdits: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS_EDITS), - allowFreeURL: toBooleanConfig(process.env.HMD_ALLOW_FREEURL), - defaultPermission: process.env.HMD_DEFAULT_PERMISSION, - dbURL: process.env.HMD_DB_URL, - sessionSecret: process.env.HMD_SESSION_SECRET, - sessionLife: toIntegerConfig(process.env.HMD_SESSION_LIFE), - imageUploadType: process.env.HMD_IMAGE_UPLOAD_TYPE, + enable: toBooleanConfig(process.env.CMD_CSP_ENABLE), + reportURI: process.env.CMD_CSP_REPORTURI + }, + protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL), + allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN), + useCDN: toBooleanConfig(process.env.CMD_USECDN), + allowAnonymous: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS), + allowAnonymousEdits: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS_EDITS), + allowFreeURL: toBooleanConfig(process.env.CMD_ALLOW_FREEURL), + defaultPermission: process.env.CMD_DEFAULT_PERMISSION, + dbURL: process.env.CMD_DB_URL, + sessionSecret: process.env.CMD_SESSION_SECRET, + sessionLife: toIntegerConfig(process.env.CMD_SESSION_LIFE), + imageUploadType: process.env.CMD_IMAGE_UPLOAD_TYPE, imgur: { - clientID: process.env.HMD_IMGUR_CLIENTID + clientID: process.env.CMD_IMGUR_CLIENTID }, s3: { - accessKeyId: process.env.HMD_S3_ACCESS_KEY_ID, - secretAccessKey: process.env.HMD_S3_SECRET_ACCESS_KEY, - region: process.env.HMD_S3_REGION + accessKeyId: process.env.CMD_S3_ACCESS_KEY_ID, + secretAccessKey: process.env.CMD_S3_SECRET_ACCESS_KEY, + region: process.env.CMD_S3_REGION }, minio: { - accessKey: process.env.HMD_MINIO_ACCESS_KEY, - secretKey: process.env.HMD_MINIO_SECRET_KEY, - endPoint: process.env.HMD_MINIO_ENDPOINT, - secure: toBooleanConfig(process.env.HMD_MINIO_SECURE), - port: toIntegerConfig(process.env.HMD_MINIO_PORT) + accessKey: process.env.CMD_MINIO_ACCESS_KEY, + secretKey: process.env.CMD_MINIO_SECRET_KEY, + endPoint: process.env.CMD_MINIO_ENDPOINT, + secure: toBooleanConfig(process.env.CMD_MINIO_SECURE), + port: toIntegerConfig(process.env.CMD_MINIO_PORT) }, - s3bucket: process.env.HMD_S3_BUCKET, + s3bucket: process.env.CMD_S3_BUCKET, azure: { - connectionString: process.env.HMD_AZURE_CONNECTION_STRING, - container: process.env.HMD_AZURE_CONTAINER + connectionString: process.env.CMD_AZURE_CONNECTION_STRING, + container: process.env.CMD_AZURE_CONTAINER }, facebook: { - clientID: process.env.HMD_FACEBOOK_CLIENTID, - clientSecret: process.env.HMD_FACEBOOK_CLIENTSECRET + clientID: process.env.CMD_FACEBOOK_CLIENTID, + clientSecret: process.env.CMD_FACEBOOK_CLIENTSECRET }, twitter: { - consumerKey: process.env.HMD_TWITTER_CONSUMERKEY, - consumerSecret: process.env.HMD_TWITTER_CONSUMERSECRET + consumerKey: process.env.CMD_TWITTER_CONSUMERKEY, + consumerSecret: process.env.CMD_TWITTER_CONSUMERSECRET }, github: { - clientID: process.env.HMD_GITHUB_CLIENTID, - clientSecret: process.env.HMD_GITHUB_CLIENTSECRET + clientID: process.env.CMD_GITHUB_CLIENTID, + clientSecret: process.env.CMD_GITHUB_CLIENTSECRET }, gitlab: { - baseURL: process.env.HMD_GITLAB_BASEURL, - clientID: process.env.HMD_GITLAB_CLIENTID, - clientSecret: process.env.HMD_GITLAB_CLIENTSECRET, - scope: process.env.HMD_GITLAB_SCOPE + baseURL: process.env.CMD_GITLAB_BASEURL, + clientID: process.env.CMD_GITLAB_CLIENTID, + clientSecret: process.env.CMD_GITLAB_CLIENTSECRET, + scope: process.env.CMD_GITLAB_SCOPE }, mattermost: { - baseURL: process.env.HMD_MATTERMOST_BASEURL, - clientID: process.env.HMD_MATTERMOST_CLIENTID, - clientSecret: process.env.HMD_MATTERMOST_CLIENTSECRET + baseURL: process.env.CMD_MATTERMOST_BASEURL, + clientID: process.env.CMD_MATTERMOST_CLIENTID, + clientSecret: process.env.CMD_MATTERMOST_CLIENTSECRET }, oauth2: { - baseURL: process.env.HMD_OAUTH2_BASEURL, - userProfileURL: process.env.HMD_OAUTH2_USER_PROFILE_URL, - userProfileUsernameAttr: process.env.HMD_OAUTH2_USER_PROFILE_USERNAME_ATTR, - userProfileDisplayNameAttr: process.env.HMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR, - userProfileEmailAttr: process.env.HMD_OAUTH2_USER_PROFILE_EMAIL_ATTR, - tokenURL: process.env.HMD_OAUTH2_TOKEN_URL, - authorizationURL: process.env.HMD_OAUTH2_AUTHORIZATION_URL, - clientID: process.env.HMD_OAUTH2_CLIENT_ID, - clientSecret: process.env.HMD_OAUTH2_CLIENT_SECRET + baseURL: process.env.CMD_OAUTH2_BASEURL, + userProfileURL: process.env.CMD_OAUTH2_USER_PROFILE_URL, + userProfileUsernameAttr: process.env.CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR, + userProfileDisplayNameAttr: process.env.CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR, + userProfileEmailAttr: process.env.CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR, + tokenURL: process.env.CMD_OAUTH2_TOKEN_URL, + authorizationURL: process.env.CMD_OAUTH2_AUTHORIZATION_URL, + clientID: process.env.CMD_OAUTH2_CLIENT_ID, + clientSecret: process.env.CMD_OAUTH2_CLIENT_SECRET }, dropbox: { - clientID: process.env.HMD_DROPBOX_CLIENTID, - clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET, - appKey: process.env.HMD_DROPBOX_APPKEY + clientID: process.env.CMD_DROPBOX_CLIENTID, + clientSecret: process.env.CMD_DROPBOX_CLIENTSECRET, + appKey: process.env.CMD_DROPBOX_APPKEY }, google: { - clientID: process.env.HMD_GOOGLE_CLIENTID, - clientSecret: process.env.HMD_GOOGLE_CLIENTSECRET + clientID: process.env.CMD_GOOGLE_CLIENTID, + clientSecret: process.env.CMD_GOOGLE_CLIENTSECRET }, ldap: { - providerName: process.env.HMD_LDAP_PROVIDERNAME, - url: process.env.HMD_LDAP_URL, - bindDn: process.env.HMD_LDAP_BINDDN, - bindCredentials: process.env.HMD_LDAP_BINDCREDENTIALS, - searchBase: process.env.HMD_LDAP_SEARCHBASE, - searchFilter: process.env.HMD_LDAP_SEARCHFILTER, - searchAttributes: toArrayConfig(process.env.HMD_LDAP_SEARCHATTRIBUTES), - usernameField: process.env.HMD_LDAP_USERNAMEFIELD, - useridField: process.env.HMD_LDAP_USERIDFIELD, - tlsca: process.env.HMD_LDAP_TLS_CA + providerName: process.env.CMD_LDAP_PROVIDERNAME, + url: process.env.CMD_LDAP_URL, + bindDn: process.env.CMD_LDAP_BINDDN, + bindCredentials: process.env.CMD_LDAP_BINDCREDENTIALS, + searchBase: process.env.CMD_LDAP_SEARCHBASE, + searchFilter: process.env.CMD_LDAP_SEARCHFILTER, + searchAttributes: toArrayConfig(process.env.CMD_LDAP_SEARCHATTRIBUTES), + usernameField: process.env.CMD_LDAP_USERNAMEFIELD, + useridField: process.env.CMD_LDAP_USERIDFIELD, + tlsca: process.env.CMD_LDAP_TLS_CA }, saml: { - idpSsoUrl: process.env.HMD_SAML_IDPSSOURL, - idpCert: process.env.HMD_SAML_IDPCERT, - issuer: process.env.HMD_SAML_ISSUER, - identifierFormat: process.env.HMD_SAML_IDENTIFIERFORMAT, - groupAttribute: process.env.HMD_SAML_GROUPATTRIBUTE, - externalGroups: toArrayConfig(process.env.HMD_SAML_EXTERNALGROUPS, '|', []), - requiredGroups: toArrayConfig(process.env.HMD_SAML_REQUIREDGROUPS, '|', []), + idpSsoUrl: process.env.CMD_SAML_IDPSSOURL, + idpCert: process.env.CMD_SAML_IDPCERT, + issuer: process.env.CMD_SAML_ISSUER, + identifierFormat: process.env.CMD_SAML_IDENTIFIERFORMAT, + groupAttribute: process.env.CMD_SAML_GROUPATTRIBUTE, + externalGroups: toArrayConfig(process.env.CMD_SAML_EXTERNALGROUPS, '|', []), + requiredGroups: toArrayConfig(process.env.CMD_SAML_REQUIREDGROUPS, '|', []), attribute: { - id: process.env.HMD_SAML_ATTRIBUTE_ID, - username: process.env.HMD_SAML_ATTRIBUTE_USERNAME, - email: process.env.HMD_SAML_ATTRIBUTE_EMAIL + id: process.env.CMD_SAML_ATTRIBUTE_ID, + username: process.env.CMD_SAML_ATTRIBUTE_USERNAME, + email: process.env.CMD_SAML_ATTRIBUTE_EMAIL } }, - email: toBooleanConfig(process.env.HMD_EMAIL), - allowEmailRegister: toBooleanConfig(process.env.HMD_ALLOW_EMAIL_REGISTER), - allowGravatar: toBooleanConfig(process.env.HMD_ALLOW_GRAVATAR), - allowPDFExport: toBooleanConfig(process.env.HMD_ALLOW_PDF_EXPORT) + email: toBooleanConfig(process.env.CMD_EMAIL), + allowEmailRegister: toBooleanConfig(process.env.CMD_ALLOW_EMAIL_REGISTER), + allowGravatar: toBooleanConfig(process.env.CMD_ALLOW_GRAVATAR), + allowPDFExport: toBooleanConfig(process.env.CMD_ALLOW_PDF_EXPORT) } diff --git a/lib/config/hackmdEnvironment.js b/lib/config/hackmdEnvironment.js new file mode 100644 index 00000000..e1c11569 --- /dev/null +++ b/lib/config/hackmdEnvironment.js @@ -0,0 +1,124 @@ +'use strict' + +const {toBooleanConfig, toArrayConfig, toIntegerConfig} = require('./utils') + +module.exports = { + domain: process.env.HMD_DOMAIN, + urlPath: process.env.HMD_URL_PATH, + port: toIntegerConfig(process.env.HMD_PORT), + urlAddPort: toBooleanConfig(process.env.HMD_URL_ADDPORT), + useSSL: toBooleanConfig(process.env.HMD_USESSL), + hsts: { + enable: toBooleanConfig(process.env.HMD_HSTS_ENABLE), + maxAgeSeconds: process.env.HMD_HSTS_MAX_AGE, + includeSubdomains: toBooleanConfig(process.env.HMD_HSTS_INCLUDE_SUBDOMAINS), + preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD) + }, + csp: { + enable: toBooleanConfig(process.env.HMD_CSP_ENABLE), + reportURI: process.env.HMD_CSP_REPORTURI + }, + protocolUseSSL: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL), + allowOrigin: toArrayConfig(process.env.HMD_ALLOW_ORIGIN), + useCDN: toBooleanConfig(process.env.HMD_USECDN), + allowAnonymous: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS), + allowAnonymousEdits: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS_EDITS), + allowFreeURL: toBooleanConfig(process.env.HMD_ALLOW_FREEURL), + defaultPermission: process.env.HMD_DEFAULT_PERMISSION, + dbURL: process.env.HMD_DB_URL, + sessionSecret: process.env.HMD_SESSION_SECRET, + sessionLife: toIntegerConfig(process.env.HMD_SESSION_LIFE), + imageUploadType: process.env.HMD_IMAGE_UPLOAD_TYPE, + imgur: { + clientID: process.env.HMD_IMGUR_CLIENTID + }, + s3: { + accessKeyId: process.env.HMD_S3_ACCESS_KEY_ID, + secretAccessKey: process.env.HMD_S3_SECRET_ACCESS_KEY, + region: process.env.HMD_S3_REGION + }, + minio: { + accessKey: process.env.HMD_MINIO_ACCESS_KEY, + secretKey: process.env.HMD_MINIO_SECRET_KEY, + endPoint: process.env.HMD_MINIO_ENDPOINT, + secure: toBooleanConfig(process.env.HMD_MINIO_SECURE), + port: toIntegerConfig(process.env.HMD_MINIO_PORT) + }, + s3bucket: process.env.HMD_S3_BUCKET, + azure: { + connectionString: process.env.HMD_AZURE_CONNECTION_STRING, + container: process.env.HMD_AZURE_CONTAINER + }, + facebook: { + clientID: process.env.HMD_FACEBOOK_CLIENTID, + clientSecret: process.env.HMD_FACEBOOK_CLIENTSECRET + }, + twitter: { + consumerKey: process.env.HMD_TWITTER_CONSUMERKEY, + consumerSecret: process.env.HMD_TWITTER_CONSUMERSECRET + }, + github: { + clientID: process.env.HMD_GITHUB_CLIENTID, + clientSecret: process.env.HMD_GITHUB_CLIENTSECRET + }, + gitlab: { + baseURL: process.env.HMD_GITLAB_BASEURL, + clientID: process.env.HMD_GITLAB_CLIENTID, + clientSecret: process.env.HMD_GITLAB_CLIENTSECRET, + scope: process.env.HMD_GITLAB_SCOPE + }, + mattermost: { + baseURL: process.env.HMD_MATTERMOST_BASEURL, + clientID: process.env.HMD_MATTERMOST_CLIENTID, + clientSecret: process.env.HMD_MATTERMOST_CLIENTSECRET + }, + oauth2: { + baseURL: process.env.HMD_OAUTH2_BASEURL, + userProfileURL: process.env.HMD_OAUTH2_USER_PROFILE_URL, + userProfileUsernameAttr: process.env.HMD_OAUTH2_USER_PROFILE_USERNAME_ATTR, + userProfileDisplayNameAttr: process.env.HMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR, + userProfileEmailAttr: process.env.HMD_OAUTH2_USER_PROFILE_EMAIL_ATTR, + tokenURL: process.env.HMD_OAUTH2_TOKEN_URL, + authorizationURL: process.env.HMD_OAUTH2_AUTHORIZATION_URL, + clientID: process.env.HMD_OAUTH2_CLIENT_ID, + clientSecret: process.env.HMD_OAUTH2_CLIENT_SECRET + }, + dropbox: { + clientID: process.env.HMD_DROPBOX_CLIENTID, + clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET, + appKey: process.env.HMD_DROPBOX_APPKEY + }, + google: { + clientID: process.env.HMD_GOOGLE_CLIENTID, + clientSecret: process.env.HMD_GOOGLE_CLIENTSECRET + }, + ldap: { + providerName: process.env.HMD_LDAP_PROVIDERNAME, + url: process.env.HMD_LDAP_URL, + bindDn: process.env.HMD_LDAP_BINDDN, + bindCredentials: process.env.HMD_LDAP_BINDCREDENTIALS, + searchBase: process.env.HMD_LDAP_SEARCHBASE, + searchFilter: process.env.HMD_LDAP_SEARCHFILTER, + searchAttributes: toArrayConfig(process.env.HMD_LDAP_SEARCHATTRIBUTES), + usernameField: process.env.HMD_LDAP_USERNAMEFIELD, + useridField: process.env.HMD_LDAP_USERIDFIELD, + tlsca: process.env.HMD_LDAP_TLS_CA + }, + saml: { + idpSsoUrl: process.env.HMD_SAML_IDPSSOURL, + idpCert: process.env.HMD_SAML_IDPCERT, + issuer: process.env.HMD_SAML_ISSUER, + identifierFormat: process.env.HMD_SAML_IDENTIFIERFORMAT, + groupAttribute: process.env.HMD_SAML_GROUPATTRIBUTE, + externalGroups: toArrayConfig(process.env.HMD_SAML_EXTERNALGROUPS, '|', []), + requiredGroups: toArrayConfig(process.env.HMD_SAML_REQUIREDGROUPS, '|', []), + attribute: { + id: process.env.HMD_SAML_ATTRIBUTE_ID, + username: process.env.HMD_SAML_ATTRIBUTE_USERNAME, + email: process.env.HMD_SAML_ATTRIBUTE_EMAIL + } + }, + email: toBooleanConfig(process.env.HMD_EMAIL), + allowEmailRegister: toBooleanConfig(process.env.HMD_ALLOW_EMAIL_REGISTER), + allowPDFExport: toBooleanConfig(process.env.HMD_ALLOW_PDF_EXPORT) +} diff --git a/lib/config/index.js b/lib/config/index.js index 79330443..760d94a1 100644 --- a/lib/config/index.js +++ b/lib/config/index.js @@ -33,6 +33,7 @@ merge(config, debugConfig) merge(config, packageConfig) merge(config, fileConfig) merge(config, require('./oldEnvironment')) +merge(config, require('./hackmdEnvironment')) merge(config, require('./environment')) merge(config, require('./dockerSecret')) @@ -122,6 +123,11 @@ for (let i = keys.length; i--;) { } } +// Notify users about the prefix change and inform them they use legacy prefix for environment variables +if (Object.keys(process.env).toString().indexOf('HMD_') !== -1) { + logger.warn('Using legacy HMD prefix for environment variables. Please change your variables in future. For details see: https://github.com/hackmdio/codimd#environment-variables-will-overwrite-other-server-configs') +} + // Generate session secret if it stays on default values if (config.sessionSecret === 'secret') { logger.warn('Session secret not set. Using random generated one. Please set `sessionSecret` in your config.js file. All users will be logged out.') |