mirror of
https://github.com/hanzoai/calendar.git
synced 2026-09-24 22:42:24 +00:00
56 lines
2.9 KiB
YAML
56 lines
2.9 KiB
YAML
# TEMPLATE ONLY — do NOT commit real values, do NOT `kubectl apply` as-is.
|
|
#
|
|
# The live `cal-secrets` Secret is populated from KMS (kms.hanzo.ai) at deploy
|
|
# time, NOT from this file. This template documents the exact keys the cal
|
|
# Deployment consumes via `envFrom: secretRef: cal-secrets`. Every value below
|
|
# is a placeholder describing what a human must provision — see the report's
|
|
# HUMAN-GATED checklist. No secrets are invented here.
|
|
#
|
|
# Populate one of two ways:
|
|
# 1) KMS-synced (preferred): store each key under kms.hanzo.ai path
|
|
# /cal (environment=prod) and let the Hanzo secret sync materialize it, OR
|
|
# 2) one-shot from a KMS-fetched .env:
|
|
# kubectl -n hanzo-cal create secret generic cal-secrets \
|
|
# --from-env-file=cal.secrets.env
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: cal-secrets
|
|
namespace: hanzo-cal
|
|
type: Opaque
|
|
stringData:
|
|
# Postgres connection (provisioned DB — see checklist). cal.com runs
|
|
# `prisma migrate deploy` against this on every boot.
|
|
DATABASE_URL: "postgresql://USER:PASSWORD@HOST:5432/calendar?sslmode=require"
|
|
# cal.com also reads DATABASE_DIRECT_URL for migrations; same DSN unless a
|
|
# separate direct (non-pooled) endpoint exists.
|
|
DATABASE_DIRECT_URL: "postgresql://USER:PASSWORD@HOST:5432/calendar?sslmode=require"
|
|
|
|
# NextAuth session signing secret. Generate: `openssl rand -base64 32`.
|
|
NEXTAUTH_SECRET: "REPLACE_openssl_rand_base64_32"
|
|
|
|
# Encrypts stored calendar/app credentials at rest in the DB.
|
|
# MUST be exactly a 32-char key: `openssl rand -base64 24` (=> 32 chars).
|
|
CALENDSO_ENCRYPTION_KEY: "REPLACE_openssl_rand_base64_24"
|
|
|
|
# Google Calendar + Google Meet + (optional) Google login. This is the JSON
|
|
# from a Google Cloud OAuth *Web application* client, pasted as a single line.
|
|
# Redirect URI registered in GCP must be https://cal.hanzo.ai/api/integrations/googlecalendar/callback
|
|
# (and .../auth/callback/google if Google login is enabled).
|
|
GOOGLE_API_CREDENTIALS: '{"web":{"client_id":"REPLACE","client_secret":"REPLACE","redirect_uris":["https://cal.hanzo.ai/api/integrations/googlecalendar/callback"]}}'
|
|
|
|
# SMTP mailbox for booking/confirmation email (nodemailer). A real mailbox —
|
|
# e.g. an M365/Google Workspace app-password account or an SES/Resend SMTP user.
|
|
EMAIL_SERVER_HOST: "REPLACE_smtp_host"
|
|
EMAIL_SERVER_PORT: "587"
|
|
EMAIL_SERVER_USER: "REPLACE_smtp_user"
|
|
EMAIL_SERVER_PASSWORD: "REPLACE_smtp_password"
|
|
|
|
# NOTE — Office 365 / Microsoft Graph calendar: cal.com does NOT read the
|
|
# MS Graph client id/secret from env. It is configured per-app in the admin
|
|
# App Store settings UI (Settings > Admin > Apps > Microsoft 365 Calendar),
|
|
# stored encrypted in the DB with CALENDSO_ENCRYPTION_KEY. Same for the
|
|
# Microsoft OAuth redirect URI
|
|
# (https://cal.hanzo.ai/api/integrations/office365calendar/callback).
|
|
# It therefore has no key here by design — see checklist item.
|