Environment variables
All the variables that configure shellgraph-server.
General
| Variable | Default | Description |
|---|---|---|
SHELLGRAPH_KEY | (required) | Master key: 32 bytes, base64. It encrypts the SSH private keys. Make it with shellgraph-server keygen. |
SHELLGRAPH_PUBLIC_URL | URL of the request | Public URL of the server, for example https://shellgraph.example.net. Set it when the server is behind a reverse proxy. The OIDC callback and the map links use it. |
SHELLGRAPH_ADMIN_GROUP | (required) | Group name for the admin role. |
SHELLGRAPH_VIEWER_GROUP | none | Group name for the viewer role. |
At least one of LDAP and OIDC must be configured, or the server does not start.
LDAP
| Variable | Default | Description |
|---|---|---|
SHELLGRAPH_LDAP_URL | none | ldap://host:389 or ldaps://host:636. This variable enables LDAP. |
SHELLGRAPH_LDAP_STARTTLS | false | Set to true for StartTLS on an ldap:// URL. |
SHELLGRAPH_LDAP_CA_FILE | system CAs | PEM file with the CA certificates of the LDAP server. |
SHELLGRAPH_LDAP_BIND_DN | anonymous | DN of the service account. |
SHELLGRAPH_LDAP_BIND_PASSWORD | none | Password of the service account. |
SHELLGRAPH_LDAP_USER_BASE | (required with LDAP) | Base DN of the users, for example ou=people,dc=example,dc=net. |
SHELLGRAPH_LDAP_USER_FILTER | (&(objectClass=inetOrgPerson)(uid={username})) | Filter that finds the user. {username} is the login, escaped. |
SHELLGRAPH_LDAP_GROUP_BASE | user base | Base DN of the groups. |
SHELLGRAPH_LDAP_GROUP_FILTER | (|(member={dn})(uniqueMember={dn})(memberUid={username})) | Filter that finds the groups of the user. {dn} is the user DN and {username} is the login, both escaped. The default works with groupOfNames, groupOfUniqueNames and posixGroup. |
OIDC
| Variable | Default | Description |
|---|---|---|
SHELLGRAPH_OIDC_ISSUER | none | Issuer URL, for example https://id.example.net. This variable enables OIDC. It must use https, except for localhost and 127.0.0.1. |
SHELLGRAPH_OIDC_CLIENT_ID | (required with OIDC) | Client ID. |
SHELLGRAPH_OIDC_CLIENT_SECRET | none | Client secret. Leave it empty for a public client. |
SHELLGRAPH_OIDC_SCOPES | openid profile email groups | Scopes. |
SHELLGRAPH_OIDC_GROUPS_CLAIM | groups | Claim with the group names. |
SHELLGRAPH_OIDC_BUTTON | Log in with OIDC | Text of the button on the login page. |
The OIDC redirect URI is <public URL>/api/auth/oidc/callback.