mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
zeekay
1943f1c093
Multi-tenant commerce and billing: orders, subscriptions, invoices, plans, usage metering and a credit ledger. One Go binary. MIT OR Apache-2.0. Claude-Session: https://claude.ai/code/session_01SAtaDFm8VDiWrhYHNNtxMw
28 lines
1.3 KiB
YAML
28 lines
1.3 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: commerce-config
|
|
namespace: hanzo
|
|
type: Opaque
|
|
stringData:
|
|
.env: |
|
|
COMMERCE_SECRET=CHANGE_ME
|
|
ENV=production
|
|
COMMERCE_DEV=false
|
|
IAM_ENABLED=true
|
|
IAM_ISSUER=http://iam.hanzo.svc.cluster.local
|
|
IAM_ACCEPTED_ISSUERS=https://hanzo.id,https://iam.hanzo.ai
|
|
IAM_CLIENT_ID=hanzo-commerce
|
|
IAM_ACCEPTED_AUDIENCES=hanzo-commerce,app-hanzo,app-hanzobot,hanzobot-client-id,hanzo-commerce-client-id,hanzo-app-client-id,app-lux,app-zoo,app-pars
|
|
IAM_JWKS_URI=http://iam.hanzo.svc.cluster.local/v1/iam/.well-known/jwks
|
|
# Edge trust boundary: strip client-supplied X-Org-Id / X-User-* and re-mint
|
|
# them from the verified IAM JWT. WITHOUT this the identity headers are
|
|
# trusted as-is and any in-cluster pod can forge X-User-IsGlobalAdmin → platform
|
|
# superadmin (Red CRIT-1). edgeauth.go is a NO-OP unless this is "true".
|
|
COMMERCE_EDGE_AUTH=true
|
|
# MUST equal the PVC mountPath in deployment.yaml (/app/commerce_data). Per-org
|
|
# money SQLite lives at $COMMERCE_DIR/orgs/<org>/data.db; if COMMERCE_DIR points
|
|
# off the mounted volume (the old /var/lib/commerce) paid balances are written to
|
|
# ephemeral rootfs and lost on restart (Red CRIT-5).
|
|
COMMERCE_DIR=/app/commerce_data
|