depau/HackMD
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Rename environment variables and add legacy support.

Browse source 
As we are no longer HackMD the short tag `HMD` doesn't match anymore. We
move it to the matching prefix `CMD` and inform our users about the
change.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
This commit is contained in:
Sheogorath 2018-06-24 13:22:51 +02:00
parent 12d11f3f3f
commit b242b59db4
No known key found for this signature in database
GPG key ID: 1F05CC3635CDDFFD
4 changed files with 291 additions and 159 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

150
README.md
View file

@ -165,80 +165,82 @@ There are some config settings you need to change in the files below.
| --------- | ------ | ----------- | | --------- | ------ | ----------- |
| `NODE_ENV` | `production` or `development` | set current environment (will apply corresponding settings in the `config.json`) | | `NODE_ENV` | `production` or `development` | set current environment (will apply corresponding settings in the `config.json`) |
| `DEBUG` | `true` or `false` | set debug mode; show more logs | | `DEBUG` | `true` or `false` | set debug mode; show more logs |
| `HMD_DOMAIN` | `codimd.org` | domain name | | `CMD_DOMAIN` | `codimd.org` | domain name |
| `HMD_URL_PATH` | `codimd` | sub URL path, like `www.example.com/<URL_PATH>` | | `CMD_URL_PATH` | `codimd` | sub URL path, like `www.example.com/<URL_PATH>` |
| `HMD_PORT` | `80` | web app port | | `CMD_PORT` | `80` | web app port |
| `HMD_ALLOW_ORIGIN` | `localhost, codimd.org` | domain name whitelist (use comma to separate) | | `CMD_ALLOW_ORIGIN` | `localhost, codimd.org` | domain name whitelist (use comma to separate) |
| `HMD_PROTOCOL_USESSL` | `true` or `false` | set to use SSL protocol for resources path (only applied when domain is set) | | `CMD_PROTOCOL_USESSL` | `true` or `false` | set to use SSL protocol for resources path (only applied when domain is set) |
| `HMD_URL_ADDPORT` | `true` or `false` | set to add port on callback URL (ports `80` or `443` won't be applied) (only applied when domain is set) | | `CMD_URL_ADDPORT` | `true` or `false` | set to add port on callback URL (ports `80` or `443` won't be applied) (only applied when domain is set) |
| `HMD_USECDN` | `true` or `false` | set to use CDN resources or not (default is `true`) | | `CMD_USECDN` | `true` or `false` | set to use CDN resources or not (default is `true`) |
| `HMD_ALLOW_ANONYMOUS` | `true` or `false` | set to allow anonymous usage (default is `true`) | | `CMD_ALLOW_ANONYMOUS` | `true` or `false` | set to allow anonymous usage (default is `true`) |
| `HMD_ALLOW_ANONYMOUS_EDITS` | `true` or `false` | if `allowAnonymous` is `true`, allow users to select `freely` permission, allowing guests to edit existing notes (default is `false`) | | `CMD_ALLOW_ANONYMOUS_EDITS` | `true` or `false` | if `allowAnonymous` is `true`, allow users to select `freely` permission, allowing guests to edit existing notes (default is `false`) |
| `HMD_ALLOW_FREEURL` | `true` or `false` | set to allow new note creation by accessing a nonexistent note URL | | `CMD_ALLOW_FREEURL` | `true` or `false` | set to allow new note creation by accessing a nonexistent note URL |
| `HMD_DEFAULT_PERMISSION` | `freely`, `editable`, `limited`, `locked` or `private` | set notes default permission (only applied on signed users) | | `CMD_DEFAULT_PERMISSION` | `freely`, `editable`, `limited`, `locked` or `private` | set notes default permission (only applied on signed users) |
| `HMD_DB_URL` | `mysql://localhost:3306/database` | set the database URL | | `CMD_DB_URL` | `mysql://localhost:3306/database` | set the database URL |
| `HMD_SESSION_SECRET` | no example | Secret used to sign the session cookie. If non is set, one will randomly generated on startup | | `CMD_SESSION_SECRET` | no example | Secret used to sign the session cookie. If non is set, one will randomly generated on startup |
| `HMD_SESSION_LIFE` | `1209600000` | Session life time. (milliseconds) | | `CMD_SESSION_LIFE` | `1209600000` | Session life time. (milliseconds) |
| `HMD_FACEBOOK_CLIENTID` | no example | Facebook API client id | | `CMD_FACEBOOK_CLIENTID` | no example | Facebook API client id |
| `HMD_FACEBOOK_CLIENTSECRET` | no example | Facebook API client secret | | `CMD_FACEBOOK_CLIENTSECRET` | no example | Facebook API client secret |
| `HMD_TWITTER_CONSUMERKEY` | no example | Twitter API consumer key | | `CMD_TWITTER_CONSUMERKEY` | no example | Twitter API consumer key |
| `HMD_TWITTER_CONSUMERSECRET` | no example | Twitter API consumer secret | | `CMD_TWITTER_CONSUMERSECRET` | no example | Twitter API consumer secret |
| `HMD_GITHUB_CLIENTID` | no example | GitHub API client id | | `CMD_GITHUB_CLIENTID` | no example | GitHub API client id |
| `HMD_GITHUB_CLIENTSECRET` | no example | GitHub API client secret | | `CMD_GITHUB_CLIENTSECRET` | no example | GitHub API client secret |
| `HMD_GITLAB_SCOPE` | `read_user` or `api` | GitLab API requested scope (default is `api`) (GitLab snippet import/export need `api` scope) | | `CMD_GITLAB_SCOPE` | `read_user` or `api` | GitLab API requested scope (default is `api`) (GitLab snippet import/export need `api` scope) |
| `HMD_GITLAB_BASEURL` | no example | GitLab authentication endpoint, set to use other endpoint than GitLab.com (optional) | | `CMD_GITLAB_BASEURL` | no example | GitLab authentication endpoint, set to use other endpoint than GitLab.com (optional) |
| `HMD_GITLAB_CLIENTID` | no example | GitLab API client id | | `CMD_GITLAB_CLIENTID` | no example | GitLab API client id |
| `HMD_GITLAB_CLIENTSECRET` | no example | GitLab API client secret | | `CMD_GITLAB_CLIENTSECRET` | no example | GitLab API client secret |
| `HMD_MATTERMOST_BASEURL` | no example | Mattermost authentication endpoint | | `CMD_MATTERMOST_BASEURL` | no example | Mattermost authentication endpoint |
| `HMD_MATTERMOST_CLIENTID` | no example | Mattermost API client id | | `CMD_MATTERMOST_CLIENTID` | no example | Mattermost API client id |
| `HMD_MATTERMOST_CLIENTSECRET` | no example | Mattermost API client secret | | `CMD_MATTERMOST_CLIENTSECRET` | no example | Mattermost API client secret |
| `HMD_DROPBOX_CLIENTID` | no example | Dropbox API client id | | `CMD_DROPBOX_CLIENTID` | no example | Dropbox API client id |
| `HMD_DROPBOX_CLIENTSECRET` | no example | Dropbox API client secret | | `CMD_DROPBOX_CLIENTSECRET` | no example | Dropbox API client secret |
| `HMD_GOOGLE_CLIENTID` | no example | Google API client id | | `CMD_GOOGLE_CLIENTID` | no example | Google API client id |
| `HMD_GOOGLE_CLIENTSECRET` | no example | Google API client secret | | `CMD_GOOGLE_CLIENTSECRET` | no example | Google API client secret |
| `HMD_LDAP_URL` | `ldap://example.com` | URL of LDAP server | | `CMD_LDAP_URL` | `ldap://example.com` | URL of LDAP server |
| `HMD_LDAP_BINDDN` | no example | bindDn for LDAP access | | `CMD_LDAP_BINDDN` | no example | bindDn for LDAP access |
| `HMD_LDAP_BINDCREDENTIALS` | no example | bindCredentials for LDAP access | | `CMD_LDAP_BINDCREDENTIALS` | no example | bindCredentials for LDAP access |
| `HMD_LDAP_SEARCHBASE` | `o=users,dc=example,dc=com` | LDAP directory to begin search from | | `CMD_LDAP_SEARCHBASE` | `o=users,dc=example,dc=com` | LDAP directory to begin search from |
| `HMD_LDAP_SEARCHFILTER` | `(uid={{username}})` | LDAP filter to search with | | `CMD_LDAP_SEARCHFILTER` | `(uid={{username}})` | LDAP filter to search with |
| `HMD_LDAP_SEARCHATTRIBUTES` | `displayName, mail` | LDAP attributes to search with (use comma to separate) | | `CMD_LDAP_SEARCHATTRIBUTES` | `displayName, mail` | LDAP attributes to search with (use comma to separate) |
| `HMD_LDAP_USERIDFIELD` | `uidNumber` or `uid` or `sAMAccountName` | The LDAP field which is used uniquely identify a user on CodiMD | | `CMD_LDAP_USERIDFIELD` | `uidNumber` or `uid` or `sAMAccountName` | The LDAP field which is used uniquely identify a user on CodiMD |
| `HMD_LDAP_USERNAMEFIELD` | Fallback to userid | The LDAP field which is used as the username on CodiMD | | `CMD_LDAP_USERNAMEFIELD` | Fallback to userid | The LDAP field which is used as the username on CodiMD |
| `HMD_LDAP_TLS_CA` | `server-cert.pem, root.pem` | Root CA for LDAP TLS in PEM format (use comma to separate) | | `CMD_LDAP_TLS_CA` | `server-cert.pem, root.pem` | Root CA for LDAP TLS in PEM format (use comma to separate) |
| `HMD_LDAP_PROVIDERNAME` | `My institution` | Optional name to be displayed at login form indicating the LDAP provider | | `CMD_LDAP_PROVIDERNAME` | `My institution` | Optional name to be displayed at login form indicating the LDAP provider |
| `HMD_SAML_IDPSSOURL` | `https://idp.example.com/sso` | authentication endpoint of IdP. for details, see [guide](docs/guides/auth.md#saml-onelogin). | | `CMD_SAML_IDPSSOURL` | `https://idp.example.com/sso` | authentication endpoint of IdP. for details, see [guide](docs/guides/auth.md#saml-onelogin). |
| `HMD_SAML_IDPCERT` | `/path/to/cert.pem` | certificate file path of IdP in PEM format | | `CMD_SAML_IDPCERT` | `/path/to/cert.pem` | certificate file path of IdP in PEM format |
| `HMD_SAML_ISSUER` | no example | identity of the service provider (optional, default: serverurl)" | | `CMD_SAML_ISSUER` | no example | identity of the service provider (optional, default: serverurl)" |
| `HMD_SAML_IDENTIFIERFORMAT` | no example | name identifier format (optional, default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`) | | `CMD_SAML_IDENTIFIERFORMAT` | no example | name identifier format (optional, default: `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress`) |
| `HMD_SAML_GROUPATTRIBUTE` | `memberOf` | attribute name for group list (optional) | | `CMD_SAML_GROUPATTRIBUTE` | `memberOf` | attribute name for group list (optional) |
| `HMD_SAML_REQUIREDGROUPS` | `Hackmd-users` | group names that allowed (use vertical bar to separate) (optional) | | `CMD_SAML_REQUIREDGROUPS` | `Hackmd-users` | group names that allowed (use vertical bar to separate) (optional) |
| `HMD_SAML_EXTERNALGROUPS` | `Temporary-staff` | group names that not allowed (use vertical bar to separate) (optional) | | `CMD_SAML_EXTERNALGROUPS` | `Temporary-staff` | group names that not allowed (use vertical bar to separate) (optional) |
| `HMD_SAML_ATTRIBUTE_ID` | `sAMAccountName` | attribute map for `id` (optional, default: NameID of SAML response) | | `CMD_SAML_ATTRIBUTE_ID` | `sAMAccountName` | attribute map for `id` (optional, default: NameID of SAML response) |
| `HMD_SAML_ATTRIBUTE_USERNAME` | `mailNickname` | attribute map for `username` (optional, default: NameID of SAML response) | | `CMD_SAML_ATTRIBUTE_USERNAME` | `mailNickname` | attribute map for `username` (optional, default: NameID of SAML response) |
| `HMD_SAML_ATTRIBUTE_EMAIL` | `mail` | attribute map for `email` (optional, default: NameID of SAML response if `HMD_SAML_IDENTIFIERFORMAT` is default) | | `CMD_SAML_ATTRIBUTE_EMAIL` | `mail` | attribute map for `email` (optional, default: NameID of SAML response if `CMD_SAML_IDENTIFIERFORMAT` is default) |
| `HMD_IMGUR_CLIENTID` | no example | Imgur API client id | | `CMD_IMGUR_CLIENTID` | no example | Imgur API client id |
| `HMD_EMAIL` | `true` or `false` | set to allow email signin | | `CMD_EMAIL` | `true` or `false` | set to allow email signin |
| `HMD_ALLOW_PDF_EXPORT` | `true` or `false` | Enable or disable PDF exports | | `CMD_ALLOW_PDF_EXPORT` | `true` or `false` | Enable or disable PDF exports |
| `HMD_ALLOW_EMAIL_REGISTER` | `true` or `false` | set to allow email register (only applied when email is set, default is `true`. Note `bin/manage_users` might help you if registration is `false`.) | | `CMD_ALLOW_EMAIL_REGISTER` | `true` or `false` | set to allow email register (only applied when email is set, default is `true`. Note `bin/manage_users` might help you if registration is `false`.) |
| `HMD_ALLOW_GRAVATAR` | `true` or `false` | set to `false` to disable gravatar as profile picture source on your instance | | `CMD_ALLOW_GRAVATAR` | `true` or `false` | set to `false` to disable gravatar as profile picture source on your instance |
| `HMD_IMAGE_UPLOAD_TYPE` | `imgur`, `s3`, `minio` or `filesystem` | Where to upload images. For S3, see our Image Upload Guides for [S3](docs/guides/s3-image-upload.md) or [Minio](docs/guides/minio-image-upload.md) | | `CMD_IMAGE_UPLOAD_TYPE` | `imgur`, `s3`, `minio` or `filesystem` | Where to upload images. For S3, see our Image Upload Guides for [S3](docs/guides/s3-image-upload.md) or [Minio](docs/guides/minio-image-upload.md) |
| `HMD_S3_ACCESS_KEY_ID` | no example | AWS access key id | | `CMD_S3_ACCESS_KEY_ID` | no example | AWS access key id |
| `HMD_S3_SECRET_ACCESS_KEY` | no example | AWS secret key | | `CMD_S3_SECRET_ACCESS_KEY` | no example | AWS secret key |
| `HMD_S3_REGION` | `ap-northeast-1` | AWS S3 region | | `CMD_S3_REGION` | `ap-northeast-1` | AWS S3 region |
| `HMD_S3_BUCKET` | no example | AWS S3 bucket name | | `CMD_S3_BUCKET` | no example | AWS S3 bucket name |
| `HMD_MINIO_ACCESS_KEY` | no example | Minio access key | | `CMD_MINIO_ACCESS_KEY` | no example | Minio access key |
| `HMD_MINIO_SECRET_KEY` | no example | Minio secret key | | `CMD_MINIO_SECRET_KEY` | no example | Minio secret key |
| `HMD_MINIO_ENDPOINT` | `minio.example.org` | Address of your Minio endpoint/instance | | `CMD_MINIO_ENDPOINT` | `minio.example.org` | Address of your Minio endpoint/instance |
| `HMD_MINIO_PORT` | `9000` | Port that is used for your Minio instance | | `CMD_MINIO_PORT` | `9000` | Port that is used for your Minio instance |
| `HMD_MINIO_SECURE` | `true` | If set to `true` HTTPS is used for Minio | | `CMD_MINIO_SECURE` | `true` | If set to `true` HTTPS is used for Minio |
| `HMD_AZURE_CONNECTION_STRING` | no example | Azure Blob Storage connection string | | `CMD_AZURE_CONNECTION_STRING` | no example | Azure Blob Storage connection string |
| `HMD_AZURE_CONTAINER` | no example | Azure Blob Storage container name (automatically created if non existent) | | `CMD_AZURE_CONTAINER` | no example | Azure Blob Storage container name (automatically created if non existent) |
| `HMD_HSTS_ENABLE` | ` true` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) | | `CMD_HSTS_ENABLE` | ` true` | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`) |
| `HMD_HSTS_INCLUDE_SUBDOMAINS` | `true` | set to include subdomains in HSTS (default is `true`) | | `CMD_HSTS_INCLUDE_SUBDOMAINS` | `true` | set to include subdomains in HSTS (default is `true`) |
| `HMD_HSTS_MAX_AGE` | `31536000` | max duration in seconds to tell clients to keep HSTS status (default is a year) | | `CMD_HSTS_MAX_AGE` | `31536000` | max duration in seconds to tell clients to keep HSTS status (default is a year) |
| `HMD_HSTS_PRELOAD` | `true` | whether to allow preloading of the site's HSTS status (e.g. into browsers) | | `CMD_HSTS_PRELOAD` | `true` | whether to allow preloading of the site's HSTS status (e.g. into browsers) |
| `HMD_CSP_ENABLE` | `true` | whether to enable Content Security Policy (directives cannot be configured with environment variables) | | `CMD_CSP_ENABLE` | `true` | whether to enable Content Security Policy (directives cannot be configured with environment variables) |
| `HMD_CSP_REPORTURI` | `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations | | `CMD_CSP_REPORTURI` | `https://<someid>.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations |
***Note:** Due to the rename process we renamed all `HMD_`-prefix variables to be `CMD_`-prefixed. The old ones continue to work.*
## Application settings `config.json` ## Application settings `config.json`

170
lib/config/environment.js
View file

@ -3,123 +3,123 @@
const {toBooleanConfig, toArrayConfig, toIntegerConfig} = require('./utils') const {toBooleanConfig, toArrayConfig, toIntegerConfig} = require('./utils')
module.exports = { module.exports = {
domain: process.env.HMD_DOMAIN, domain: process.env.CMD_DOMAIN,
urlPath: process.env.HMD_URL_PATH, urlPath: process.env.CMD_URL_PATH,
port: toIntegerConfig(process.env.HMD_PORT), port: toIntegerConfig(process.env.CMD_PORT),
urlAddPort: toBooleanConfig(process.env.HMD_URL_ADDPORT), urlAddPort: toBooleanConfig(process.env.CMD_URL_ADDPORT),
useSSL: toBooleanConfig(process.env.HMD_USESSL), useSSL: toBooleanConfig(process.env.CMD_USESSL),
hsts: { hsts: {
enable: toBooleanConfig(process.env.HMD_HSTS_ENABLE), enable: toBooleanConfig(process.env.CMD_HSTS_ENABLE),
maxAgeSeconds: process.env.HMD_HSTS_MAX_AGE, maxAgeSeconds: process.env.CMD_HSTS_MAX_AGE,
includeSubdomains: toBooleanConfig(process.env.HMD_HSTS_INCLUDE_SUBDOMAINS), includeSubdomains: toBooleanConfig(process.env.CMD_HSTS_INCLUDE_SUBDOMAINS),
preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD) preload: toBooleanConfig(process.env.CMD_HSTS_PRELOAD)
}, },
csp: { csp: {
enable: toBooleanConfig(process.env.HMD_CSP_ENABLE), enable: toBooleanConfig(process.env.CMD_CSP_ENABLE),
reportURI: process.env.HMD_CSP_REPORTURI reportURI: process.env.CMD_CSP_REPORTURI
}, },
protocolUseSSL: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL), protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL),
allowOrigin: toArrayConfig(process.env.HMD_ALLOW_ORIGIN), allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN),
useCDN: toBooleanConfig(process.env.HMD_USECDN), useCDN: toBooleanConfig(process.env.CMD_USECDN),
allowAnonymous: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS), allowAnonymous: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS),
allowAnonymousEdits: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS_EDITS), allowAnonymousEdits: toBooleanConfig(process.env.CMD_ALLOW_ANONYMOUS_EDITS),
allowFreeURL: toBooleanConfig(process.env.HMD_ALLOW_FREEURL), allowFreeURL: toBooleanConfig(process.env.CMD_ALLOW_FREEURL),
defaultPermission: process.env.HMD_DEFAULT_PERMISSION, defaultPermission: process.env.CMD_DEFAULT_PERMISSION,
dbURL: process.env.HMD_DB_URL, dbURL: process.env.CMD_DB_URL,
sessionSecret: process.env.HMD_SESSION_SECRET, sessionSecret: process.env.CMD_SESSION_SECRET,
sessionLife: toIntegerConfig(process.env.HMD_SESSION_LIFE), sessionLife: toIntegerConfig(process.env.CMD_SESSION_LIFE),
imageUploadType: process.env.HMD_IMAGE_UPLOAD_TYPE, imageUploadType: process.env.CMD_IMAGE_UPLOAD_TYPE,
imgur: { imgur: {
clientID: process.env.HMD_IMGUR_CLIENTID clientID: process.env.CMD_IMGUR_CLIENTID
}, },
s3: { s3: {
accessKeyId: process.env.HMD_S3_ACCESS_KEY_ID, accessKeyId: process.env.CMD_S3_ACCESS_KEY_ID,
secretAccessKey: process.env.HMD_S3_SECRET_ACCESS_KEY, secretAccessKey: process.env.CMD_S3_SECRET_ACCESS_KEY,
region: process.env.HMD_S3_REGION region: process.env.CMD_S3_REGION
}, },
minio: { minio: {
accessKey: process.env.HMD_MINIO_ACCESS_KEY, accessKey: process.env.CMD_MINIO_ACCESS_KEY,
secretKey: process.env.HMD_MINIO_SECRET_KEY, secretKey: process.env.CMD_MINIO_SECRET_KEY,
endPoint: process.env.HMD_MINIO_ENDPOINT, endPoint: process.env.CMD_MINIO_ENDPOINT,
secure: toBooleanConfig(process.env.HMD_MINIO_SECURE), secure: toBooleanConfig(process.env.CMD_MINIO_SECURE),
port: toIntegerConfig(process.env.HMD_MINIO_PORT) port: toIntegerConfig(process.env.CMD_MINIO_PORT)
}, },
s3bucket: process.env.HMD_S3_BUCKET, s3bucket: process.env.CMD_S3_BUCKET,
azure: { azure: {
connectionString: process.env.HMD_AZURE_CONNECTION_STRING, connectionString: process.env.CMD_AZURE_CONNECTION_STRING,
container: process.env.HMD_AZURE_CONTAINER container: process.env.CMD_AZURE_CONTAINER
}, },
facebook: { facebook: {
clientID: process.env.HMD_FACEBOOK_CLIENTID, clientID: process.env.CMD_FACEBOOK_CLIENTID,
clientSecret: process.env.HMD_FACEBOOK_CLIENTSECRET clientSecret: process.env.CMD_FACEBOOK_CLIENTSECRET
}, },
twitter: { twitter: {
consumerKey: process.env.HMD_TWITTER_CONSUMERKEY, consumerKey: process.env.CMD_TWITTER_CONSUMERKEY,
consumerSecret: process.env.HMD_TWITTER_CONSUMERSECRET consumerSecret: process.env.CMD_TWITTER_CONSUMERSECRET
}, },
github: { github: {
clientID: process.env.HMD_GITHUB_CLIENTID, clientID: process.env.CMD_GITHUB_CLIENTID,
clientSecret: process.env.HMD_GITHUB_CLIENTSECRET clientSecret: process.env.CMD_GITHUB_CLIENTSECRET
}, },
gitlab: { gitlab: {
baseURL: process.env.HMD_GITLAB_BASEURL, baseURL: process.env.CMD_GITLAB_BASEURL,
clientID: process.env.HMD_GITLAB_CLIENTID, clientID: process.env.CMD_GITLAB_CLIENTID,
clientSecret: process.env.HMD_GITLAB_CLIENTSECRET, clientSecret: process.env.CMD_GITLAB_CLIENTSECRET,
scope: process.env.HMD_GITLAB_SCOPE scope: process.env.CMD_GITLAB_SCOPE
}, },
mattermost: { mattermost: {
baseURL: process.env.HMD_MATTERMOST_BASEURL, baseURL: process.env.CMD_MATTERMOST_BASEURL,
clientID: process.env.HMD_MATTERMOST_CLIENTID, clientID: process.env.CMD_MATTERMOST_CLIENTID,
clientSecret: process.env.HMD_MATTERMOST_CLIENTSECRET clientSecret: process.env.CMD_MATTERMOST_CLIENTSECRET
}, },
oauth2: { oauth2: {
baseURL: process.env.HMD_OAUTH2_BASEURL, baseURL: process.env.CMD_OAUTH2_BASEURL,
userProfileURL: process.env.HMD_OAUTH2_USER_PROFILE_URL, userProfileURL: process.env.CMD_OAUTH2_USER_PROFILE_URL,
userProfileUsernameAttr: process.env.HMD_OAUTH2_USER_PROFILE_USERNAME_ATTR, userProfileUsernameAttr: process.env.CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR,
userProfileDisplayNameAttr: process.env.HMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR, userProfileDisplayNameAttr: process.env.CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR,
userProfileEmailAttr: process.env.HMD_OAUTH2_USER_PROFILE_EMAIL_ATTR, userProfileEmailAttr: process.env.CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR,
tokenURL: process.env.HMD_OAUTH2_TOKEN_URL, tokenURL: process.env.CMD_OAUTH2_TOKEN_URL,
authorizationURL: process.env.HMD_OAUTH2_AUTHORIZATION_URL, authorizationURL: process.env.CMD_OAUTH2_AUTHORIZATION_URL,
clientID: process.env.HMD_OAUTH2_CLIENT_ID, clientID: process.env.CMD_OAUTH2_CLIENT_ID,
clientSecret: process.env.HMD_OAUTH2_CLIENT_SECRET clientSecret: process.env.CMD_OAUTH2_CLIENT_SECRET
}, },
dropbox: { dropbox: {
clientID: process.env.HMD_DROPBOX_CLIENTID, clientID: process.env.CMD_DROPBOX_CLIENTID,
clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET, clientSecret: process.env.CMD_DROPBOX_CLIENTSECRET,
appKey: process.env.HMD_DROPBOX_APPKEY appKey: process.env.CMD_DROPBOX_APPKEY
}, },
google: { google: {
clientID: process.env.HMD_GOOGLE_CLIENTID, clientID: process.env.CMD_GOOGLE_CLIENTID,
clientSecret: process.env.HMD_GOOGLE_CLIENTSECRET clientSecret: process.env.CMD_GOOGLE_CLIENTSECRET
}, },
ldap: { ldap: {
providerName: process.env.HMD_LDAP_PROVIDERNAME, providerName: process.env.CMD_LDAP_PROVIDERNAME,
url: process.env.HMD_LDAP_URL, url: process.env.CMD_LDAP_URL,
bindDn: process.env.HMD_LDAP_BINDDN, bindDn: process.env.CMD_LDAP_BINDDN,
bindCredentials: process.env.HMD_LDAP_BINDCREDENTIALS, bindCredentials: process.env.CMD_LDAP_BINDCREDENTIALS,
searchBase: process.env.HMD_LDAP_SEARCHBASE, searchBase: process.env.CMD_LDAP_SEARCHBASE,
searchFilter: process.env.HMD_LDAP_SEARCHFILTER, searchFilter: process.env.CMD_LDAP_SEARCHFILTER,
searchAttributes: toArrayConfig(process.env.HMD_LDAP_SEARCHATTRIBUTES), searchAttributes: toArrayConfig(process.env.CMD_LDAP_SEARCHATTRIBUTES),
usernameField: process.env.HMD_LDAP_USERNAMEFIELD, usernameField: process.env.CMD_LDAP_USERNAMEFIELD,
useridField: process.env.HMD_LDAP_USERIDFIELD, useridField: process.env.CMD_LDAP_USERIDFIELD,
tlsca: process.env.HMD_LDAP_TLS_CA tlsca: process.env.CMD_LDAP_TLS_CA
}, },
saml: { saml: {
idpSsoUrl: process.env.HMD_SAML_IDPSSOURL, idpSsoUrl: process.env.CMD_SAML_IDPSSOURL,
idpCert: process.env.HMD_SAML_IDPCERT, idpCert: process.env.CMD_SAML_IDPCERT,
issuer: process.env.HMD_SAML_ISSUER, issuer: process.env.CMD_SAML_ISSUER,
identifierFormat: process.env.HMD_SAML_IDENTIFIERFORMAT, identifierFormat: process.env.CMD_SAML_IDENTIFIERFORMAT,
groupAttribute: process.env.HMD_SAML_GROUPATTRIBUTE, groupAttribute: process.env.CMD_SAML_GROUPATTRIBUTE,
externalGroups: toArrayConfig(process.env.HMD_SAML_EXTERNALGROUPS, '|', []), externalGroups: toArrayConfig(process.env.CMD_SAML_EXTERNALGROUPS, '|', []),
requiredGroups: toArrayConfig(process.env.HMD_SAML_REQUIREDGROUPS, '|', []), requiredGroups: toArrayConfig(process.env.CMD_SAML_REQUIREDGROUPS, '|', []),
attribute: { attribute: {
id: process.env.HMD_SAML_ATTRIBUTE_ID, id: process.env.CMD_SAML_ATTRIBUTE_ID,
username: process.env.HMD_SAML_ATTRIBUTE_USERNAME, username: process.env.CMD_SAML_ATTRIBUTE_USERNAME,
email: process.env.HMD_SAML_ATTRIBUTE_EMAIL email: process.env.CMD_SAML_ATTRIBUTE_EMAIL
} }
}, },
email: toBooleanConfig(process.env.HMD_EMAIL), email: toBooleanConfig(process.env.CMD_EMAIL),
allowEmailRegister: toBooleanConfig(process.env.HMD_ALLOW_EMAIL_REGISTER), allowEmailRegister: toBooleanConfig(process.env.CMD_ALLOW_EMAIL_REGISTER),
allowGravatar: toBooleanConfig(process.env.HMD_ALLOW_GRAVATAR), allowGravatar: toBooleanConfig(process.env.CMD_ALLOW_GRAVATAR),
allowPDFExport: toBooleanConfig(process.env.HMD_ALLOW_PDF_EXPORT) allowPDFExport: toBooleanConfig(process.env.CMD_ALLOW_PDF_EXPORT)
} }

124
lib/config/hackmdEnvironment.js Normal file
View file

@ -0,0 +1,124 @@
'use strict'
const {toBooleanConfig, toArrayConfig, toIntegerConfig} = require('./utils')
module.exports = {
domain: process.env.HMD_DOMAIN,
urlPath: process.env.HMD_URL_PATH,
port: toIntegerConfig(process.env.HMD_PORT),
urlAddPort: toBooleanConfig(process.env.HMD_URL_ADDPORT),
useSSL: toBooleanConfig(process.env.HMD_USESSL),
hsts: {
enable: toBooleanConfig(process.env.HMD_HSTS_ENABLE),
maxAgeSeconds: process.env.HMD_HSTS_MAX_AGE,
includeSubdomains: toBooleanConfig(process.env.HMD_HSTS_INCLUDE_SUBDOMAINS),
preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD)
},
csp: {
enable: toBooleanConfig(process.env.HMD_CSP_ENABLE),
reportURI: process.env.HMD_CSP_REPORTURI
},
protocolUseSSL: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL),
allowOrigin: toArrayConfig(process.env.HMD_ALLOW_ORIGIN),
useCDN: toBooleanConfig(process.env.HMD_USECDN),
allowAnonymous: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS),
allowAnonymousEdits: toBooleanConfig(process.env.HMD_ALLOW_ANONYMOUS_EDITS),
allowFreeURL: toBooleanConfig(process.env.HMD_ALLOW_FREEURL),
defaultPermission: process.env.HMD_DEFAULT_PERMISSION,
dbURL: process.env.HMD_DB_URL,
sessionSecret: process.env.HMD_SESSION_SECRET,
sessionLife: toIntegerConfig(process.env.HMD_SESSION_LIFE),
imageUploadType: process.env.HMD_IMAGE_UPLOAD_TYPE,
imgur: {
clientID: process.env.HMD_IMGUR_CLIENTID
},
s3: {
accessKeyId: process.env.HMD_S3_ACCESS_KEY_ID,
secretAccessKey: process.env.HMD_S3_SECRET_ACCESS_KEY,
region: process.env.HMD_S3_REGION
},
minio: {
accessKey: process.env.HMD_MINIO_ACCESS_KEY,
secretKey: process.env.HMD_MINIO_SECRET_KEY,
endPoint: process.env.HMD_MINIO_ENDPOINT,
secure: toBooleanConfig(process.env.HMD_MINIO_SECURE),
port: toIntegerConfig(process.env.HMD_MINIO_PORT)
},
s3bucket: process.env.HMD_S3_BUCKET,
azure: {
connectionString: process.env.HMD_AZURE_CONNECTION_STRING,
container: process.env.HMD_AZURE_CONTAINER
},
facebook: {
clientID: process.env.HMD_FACEBOOK_CLIENTID,
clientSecret: process.env.HMD_FACEBOOK_CLIENTSECRET
},
twitter: {
consumerKey: process.env.HMD_TWITTER_CONSUMERKEY,
consumerSecret: process.env.HMD_TWITTER_CONSUMERSECRET
},
github: {
clientID: process.env.HMD_GITHUB_CLIENTID,
clientSecret: process.env.HMD_GITHUB_CLIENTSECRET
},
gitlab: {
baseURL: process.env.HMD_GITLAB_BASEURL,
clientID: process.env.HMD_GITLAB_CLIENTID,
clientSecret: process.env.HMD_GITLAB_CLIENTSECRET,
scope: process.env.HMD_GITLAB_SCOPE
},
mattermost: {
baseURL: process.env.HMD_MATTERMOST_BASEURL,
clientID: process.env.HMD_MATTERMOST_CLIENTID,
clientSecret: process.env.HMD_MATTERMOST_CLIENTSECRET
},
oauth2: {
baseURL: process.env.HMD_OAUTH2_BASEURL,
userProfileURL: process.env.HMD_OAUTH2_USER_PROFILE_URL,
userProfileUsernameAttr: process.env.HMD_OAUTH2_USER_PROFILE_USERNAME_ATTR,
userProfileDisplayNameAttr: process.env.HMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR,
userProfileEmailAttr: process.env.HMD_OAUTH2_USER_PROFILE_EMAIL_ATTR,
tokenURL: process.env.HMD_OAUTH2_TOKEN_URL,
authorizationURL: process.env.HMD_OAUTH2_AUTHORIZATION_URL,
clientID: process.env.HMD_OAUTH2_CLIENT_ID,
clientSecret: process.env.HMD_OAUTH2_CLIENT_SECRET
},
dropbox: {
clientID: process.env.HMD_DROPBOX_CLIENTID,
clientSecret: process.env.HMD_DROPBOX_CLIENTSECRET,
appKey: process.env.HMD_DROPBOX_APPKEY
},
google: {
clientID: process.env.HMD_GOOGLE_CLIENTID,
clientSecret: process.env.HMD_GOOGLE_CLIENTSECRET
},
ldap: {
providerName: process.env.HMD_LDAP_PROVIDERNAME,
url: process.env.HMD_LDAP_URL,
bindDn: process.env.HMD_LDAP_BINDDN,
bindCredentials: process.env.HMD_LDAP_BINDCREDENTIALS,
searchBase: process.env.HMD_LDAP_SEARCHBASE,
searchFilter: process.env.HMD_LDAP_SEARCHFILTER,
searchAttributes: toArrayConfig(process.env.HMD_LDAP_SEARCHATTRIBUTES),
usernameField: process.env.HMD_LDAP_USERNAMEFIELD,
useridField: process.env.HMD_LDAP_USERIDFIELD,
tlsca: process.env.HMD_LDAP_TLS_CA
},
saml: {
idpSsoUrl: process.env.HMD_SAML_IDPSSOURL,
idpCert: process.env.HMD_SAML_IDPCERT,
issuer: process.env.HMD_SAML_ISSUER,
identifierFormat: process.env.HMD_SAML_IDENTIFIERFORMAT,
groupAttribute: process.env.HMD_SAML_GROUPATTRIBUTE,
externalGroups: toArrayConfig(process.env.HMD_SAML_EXTERNALGROUPS, '|', []),
requiredGroups: toArrayConfig(process.env.HMD_SAML_REQUIREDGROUPS, '|', []),
attribute: {
id: process.env.HMD_SAML_ATTRIBUTE_ID,
username: process.env.HMD_SAML_ATTRIBUTE_USERNAME,
email: process.env.HMD_SAML_ATTRIBUTE_EMAIL
}
},
email: toBooleanConfig(process.env.HMD_EMAIL),
allowEmailRegister: toBooleanConfig(process.env.HMD_ALLOW_EMAIL_REGISTER),
allowPDFExport: toBooleanConfig(process.env.HMD_ALLOW_PDF_EXPORT)
}

6
lib/config/index.js
View file

@ -33,6 +33,7 @@ merge(config, debugConfig)
merge(config, packageConfig) merge(config, packageConfig)
merge(config, fileConfig) merge(config, fileConfig)
merge(config, require('./oldEnvironment')) merge(config, require('./oldEnvironment'))
merge(config, require('./hackmdEnvironment'))
merge(config, require('./environment')) merge(config, require('./environment'))
merge(config, require('./dockerSecret')) merge(config, require('./dockerSecret'))
@ -122,6 +123,11 @@ for (let i = keys.length; i--;) {
} }
} }
// Notify users about the prefix change and inform them they use legacy prefix for environment variables
if (Object.keys(process.env).toString().indexOf('HMD_') !== -1) {
logger.warn('Using legacy HMD prefix for environment variables. Please change your variables in future. For details see: https://github.com/hackmdio/codimd#environment-variables-will-overwrite-other-server-configs')
}
// Generate session secret if it stays on default values // Generate session secret if it stays on default values
if (config.sessionSecret === 'secret') { if (config.sessionSecret === 'secret') {
logger.warn('Session secret not set. Using random generated one. Please set `sessionSecret` in your config.js file. All users will be logged out.') logger.warn('Session secret not set. Using random generated one. Please set `sessionSecret` in your config.js file. All users will be logged out.')