-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path.env.example
More file actions
62 lines (52 loc) · 3.5 KB
/
Copy path.env.example
File metadata and controls
62 lines (52 loc) · 3.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# ==============================================================================
# Enterprise MCP Router Gateway - Production Environment Template
# ==============================================================================
# Database Provider selection. Supported values: 'sqlite', 'mssql', 'mysql'.
# Default: sqlite (if left blank or omitted)
DB_PROVIDER=sqlite
# Connection string for the chosen DB_PROVIDER.
# Examples:
# SQLite (default): Data Source=data/mcp_router.db
# MS SQL Server: Server=tcp:sqlserver.local,1433;Database=McpEnterpriseDb;User ID=mcp_user;Password=SecurePassword123!;TrustServerCertificate=True
# MySQL: Server=mysql.local;Port=3306;Database=McpEnterpriseDb;Uid=mcp_user;Pwd=SecurePassword123!;
ConnectionStrings__DefaultConnection=Data Source=data/mcp_router.db
# Mandatory: Router Master Key (Base64 or hex encoded, 256-bit cryptographically secure key).
# Used to encrypt downstream server credentials, API tokens, and configurations in the database.
# FATAL if missing or invalid in production!
ROUTER_MASTER_KEY=YourSuperSecureHighEntropyBase64EncodedKeyHere==
# Configures allowed web browser origins for CORS. Comma, semicolon, or space-separated list.
# Default: Safe localhost origins in Dev mode. Empty/unset in Prod locks out all browsers.
# Example: CORS_ALLOWED_ORIGINS=http://localhost:3000,https://mcp-dashboard.enterprise.com
CORS_ALLOWED_ORIGINS=https://mcp-dashboard.enterprise.com
# Filepath to the PFX/PKCS#12 certificate used to sign OAuth/OIDC tokens in production.
# Required in production. If unset/blank, the gateway will fallback to ephemeral signing
# credentials which reset on every application restart, invalidating active client tokens.
OpenIddict__CertificatePath=/app/certs/oauth_signing.pfx
OpenIddict__CertificatePassword=MySecretCertPassword123!
# Active Directory Group Security Identifier (SID) representing global gateway Administrators.
# Any user whose resolved identity contains this Group SID will be granted full administrative privileges.
# Default standard: S-1-5-32-544 (Local Administrators)
Admin__GroupSid=S-1-5-32-544
Admin__GroupName=full_admin
Admin__Groups__0=full_admin
Admin__Groups__1=Administrator
Admin__Groups__2=Administrators
# Standalone mode authorized network subnets (used when no external IDP is configured).
# Defaults to loopback (127.0.0.1, ::1). Set to your LAN CIDR or 0.0.0.0/0 for open private network access.
Admin__StandaloneAllowedNetworks__0=127.0.0.1
Admin__StandaloneAllowedNetworks__1=::1
# Admin__StandaloneAllowedNetworks__2=10.0.0.0/8
# Admin__StandaloneAllowedNetworks__3=0.0.0.0/0
# Comma-separated list of upstream reverse proxy IP addresses trusted by the gateway.
# REQUIRED if using Oidc:RequireTrustedProxy=true and header-based SSO identity.
# Fallback/Default: Strictly trusts local loopback (127.0.0.1 and ::1) only!
# Set this explicitly if your gateway resides behind a Docker bridge network (e.g., 172.17.0.1 or 10.0.0.x).
Oidc__TrustedProxies=10.0.5.10,172.17.0.1
# Enforce proxy IP validation. If set to true (highly recommended), SSO headers will
# be completely stripped for any incoming request originating from an untrusted client IP.
Oidc__RequireTrustedProxy=true
# Custom headers used to extract user Identity SIDs during proxy header authentication.
# Comma-separated list of HTTP request headers.
# Default fallback includes: X-Forwarded-Groups, Remote-Groups, sso_groups
Identity__HeaderAuth__UserHeaders=Remote-User,X-Forwarded-User
Identity__HeaderAuth__GroupHeaders=Remote-Groups,X-Forwarded-Groups,sso_groups