@o3co/create-auth-provider 0.17.0-rc.4 → 0.18.0-rc.1

package/templates/standalone/config/application.conf

@@ -1,351 +0,0 @@
-# Application-level overrides for the standalone template.
-#
-# Defaults come from config/reference.conf (the template's own modules) and
-# from the reference.conf of each package its modules come from, core's last.
-# Values omitted here inherit from them; add overrides only for keys this
-# deployment intentionally diverges on. Write a value for a key the last
-# block of this file binds above that block: one written below it wins over
-# the variable.
-
-# Which adapter fills each slot -- the stores, the repositories, the audit
-# sink -- is the template's own `adapters` section, whose defaults
-# config/reference.conf holds with each one's variable (ADAPTERS_*). Override
-# one in a layer of your own or with its variable:
-#
-#   adapters.rateLimiter = "redis"
-#
-# The audit stream's level is FIXED at info and `logging.level` does not gate
-# it: LOGGING_LEVEL=warn is an ordinary production setting and
-# LOGGING_LEVEL=silent a legitimate one, and either silencing the audit trail
-# would lose the record of every security event.
-
-# The grant switches, each in the section of the module that installs the
-# grant. The template is a typical web-app OP, so it turns on the universal
-# user-auth path: the session grant (oauth-session) and the authorization-code
-# and refresh-token grants (oauth-authorization). client_credentials and the
-# jwt-bearer grant stay off; deployments that need M2M flows set
-# OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED=true or write
-# `oauth-authorization.grants.clientCredentials.enabled = true` in their own
-# layer.
-#
-# The modules read these switches at boot, from the configuration boot parses;
-# the template reads none of them before. This file writes the template's
-# choices and binds each variable again: the env-override line is repeated
-# after each value because a layer's own value wins over a variable bound
-# below it.
-#
-# PKCE is mandatory for every authorization-code client and `S256` is the only
-# method the provider accepts -- fixed policy (OAuth 2.1 §4.1.1 / RFC 9700
-# §2.1.1), not a deployment setting. A legacy client that genuinely cannot
-# compute SHA-256 is opted into `plain` one client at a time, with
-# `allowPlainPkce: true` in clients.yaml.
-oauth-session {
-  enabled = true
-  enabled = ${?OAUTH_SESSION_ENABLED}
-}
-
-oauth-authorization.grants {
-  authorizationCode {
-    enabled = true
-    enabled = ${?OAUTH_AUTHORIZATION_GRANTS_AUTHORIZATION_CODE_ENABLED}
-  }
-  refreshToken {
-    enabled = true
-    enabled = ${?OAUTH_AUTHORIZATION_GRANTS_REFRESH_TOKEN_ENABLED}
-  }
-  clientCredentials {
-    enabled = false
-    enabled = ${?OAUTH_AUTHORIZATION_GRANTS_CLIENT_CREDENTIALS_ENABLED}
-  }
-  jwtBearer {
-    enabled = false
-    enabled = ${?OAUTH_AUTHORIZATION_GRANTS_JWT_BEARER_ENABLED}
-  }
-}
-
-oauth {
-  # The Authentication Context Class References this deployment can
-  # vouch for, each mapped to the RFC 8176 `amr` values a session must carry
-  # (`pwd` for a password login, `fed` for a federated login) — or to a list
-  # of such lists, any one of which satisfies it. `/authorize` answers
-  # `acr_values` from this table alone — anything else is
-  # `unmet_authentication_requirements` — and discovery advertises the keys.
-  #
-  #   authorize.acrValues {
-  #     "urn:example:pwd" = ["pwd"]
-  #   }
-  #
-  # An entry nothing this deployment installs can satisfy is dropped at boot:
-  # not advertised, answered `unmet_authentication_requirements`, and logged
-  # once as `acr_value_unsatisfiable`. One that needs `fed` needs a
-  # federation installed; one that needs `mfa`, `hwk` or `swk` needs MFA
-  # installed (MFA_MODE, below), or a federation that trusts its upstream
-  # IdP's `amr`. One that lacks only a second factor while MFA is off is
-  # logged at info, not warn.
-  #
-  # While MFA_MODE installs MFA, the template adds `"urn:o3co:acr:mfa" =
-  # ["mfa"]`, met by a session with a verified second factor, unless this
-  # table writes that entry itself; with MFA off it adds nothing.
-  # Phishing-resistant authentication would be:
-  #
-  #   "urn:o3co:acr:phr" = [["hwk"], ["swk"]]
-
-  # /authorize refuses any client not marked `firstParty: true` in
-  # clients.yaml — the template's example clients are marked. There is no
-  # opt-out: the one-time `allowUnmarkedClients` migration flag is removed,
-  # and a config or environment still setting it fails at boot: the oauth
-  # module refuses the key as removed, and an exported
-  # OAUTH_AUTHORIZE_ALLOW_UNMARKED_CLIENTS as the variable of a removed key.
-  # POST /oauth/revoke revokes access tokens by writing their `jti` to the
-  # denylist wired below, and boot FAILS if that denylist is missing — an
-  # RFC 7009 endpoint must answer 200, so an unwired denylist would tell every
-  # operator their token is revoked while it kept working until expiry.
-  #
-  # Deployments that genuinely do not revoke access tokens (short-lived tokens
-  # plus refresh-token revocation only) set "unsupported" instead, and the
-  # endpoint then answers `unsupported_token_type` for
-  # `token_type_hint = access_token`. Refresh-token revocation works in both
-  # modes and needs no denylist.
-  revocation {
-    accessToken = "denylist"
-    accessToken = ${?OAUTH_REVOCATION_ACCESS_TOKEN}
-  }
-}
-
-# The session requirements this deployment expects, in core's own section:
-# the extensions that change what "logged in" means, each registered by a
-# module (the MFA package's is named `mfa`). Boot compares the list with what
-# the installed modules register: a name here that nothing registers refuses
-# the boot (`session-requirement-missing`), and so does a registered
-# requirement the list leaves out (`session-requirements-undeclared`). When
-# MFA_MODE (`mfaMode`, config/reference.conf) installs MFA, the template
-# adds `mfa` to this list and writes `secondFactorAuthority = "mfa"` beside
-# it (one written here other than `mfa` refuses the boot); a deployment that
-# adds a module registering a
-# requirement of its own adds its name here. No environment variable sets the
-# list.
-core.sessionRequirements.expected = []
-
-# Multi-factor authentication, installed by MFA_MODE (`mfaMode`,
-# config/reference.conf): "off" (unset) installs nothing of it; "optional" or
-# "required" installs the MFA package's modules (the TOTP, recovery-code and
-# email factors, the operator reset) and writes `mfa.mode` from the switch.
-# The MFA package's reference.conf holds the `mfa` section with its
-# variables: the key ring's first key, MFA_ENCRYPTION_KEY (`openssl rand
-# -base64 32`; none, and the boot is refused), and the page a step-up starts
-# on, MFA_PAGE_URL (`/mfa`). One Store call's time, MFA_STORE_TIMEOUT_MS
-# (5000 ms), must be at least every store's own per-call timeout, the user
-# directory's REPOSITORIES_USER_HTTP_TIMEOUT among them: raise the two
-# together; above 37500 ms the boot is refused. Mail --
-# the account-email proof, the email factor's codes -- goes through the mail
-# sender, which needs STANDARD_SMTP_MAIL_SENDER_HOST and
-# STANDARD_SMTP_MAIL_SENDER_FROM outside development. While MFA is off,
-# nothing written under `mfa` is read.
-
-# Federation grants — a user's standing consent that a backend or an
-# agent may obtain upstream IdP tokens with no session behind the call. Off by
-# default; FEDERATION_GRANTS_ENABLED=true installs the routes, the two stores
-# `adapters.federationGrantStore` and `.federationGrantIntentStore` select
-# (none by default, which boot refuses naming the store) and the
-# subject-revocation service. Enabling it is a statement that
-# the deployment has a consent page (FEDERATION_GRANTS_CONSENT_URL, no default),
-# a `callbackURL` on every connection, and a user repository that covers each
-# connection's registration (or FEDERATION_GRANTS_IDENTITY_LOOKUP=unsupported,
-# the recorded decision not to make that check) — each refused at boot when
-# missing. Connections and the Redis grant store's key ring have no
-# environment form; write them in a deployment-owned HOCON layer (README:
-# Federation Grants). The section's defaults and its other variables
-# (FEDERATION_GRANTS_IDENTITY_LOOKUP, FEDERATION_GRANTS_CONSENT_URL) are the
-# federation-grants package's reference.conf, and the Redis grant store's
-# (REDIS_FEDERATION_GRANT_STORE_ENCRYPTION_MODE, "required" by default) the
-# Redis package's: each is layered only where a module of its package is
-# installed. The
-# template reads `federation-grants.enabled` before it chooses its modules,
-# from its own files, which is why this file binds FEDERATION_GRANTS_ENABLED;
-# unset, it writes nothing, and the feature is off.
-federation-grants.enabled = ${?FEDERATION_GRANTS_ENABLED}
-
-# The session store's section: the session cookie and the store
-# express-session keeps sessions in. A memory store declares itself
-# replica-unsafe from this section.
-session-store {
-  secret = ${?SESSION_STORE_SECRET}
-  # A `__Host-` name requires Secure, Path=/ and no Domain attribute. If
-  # SESSION_STORE_SECURE=false or SESSION_STORE_DOMAIN is set, also set
-  # SESSION_STORE_NAME to a name without the prefix.
-  name = "__Host-auth.session"
-  name = ${?SESSION_STORE_NAME}
-  maxAge = 3600000
-  maxAge = ${?SESSION_STORE_MAX_AGE}
-  secure = true
-  secure = ${?SESSION_STORE_SECURE}
-  sameSite = "lax"
-  sameSite = ${?SESSION_STORE_SAME_SITE}
-  domain = null
-  domain = ${?SESSION_STORE_DOMAIN}
-  storage {
-    type = "redis"
-    type = ${?SESSION_STORE_STORAGE_TYPE}
-    redis {
-      url = "redis://localhost:6379"
-      url = ${?SESSION_STORE_STORAGE_REDIS_URL}
-      password = ${?SESSION_STORE_STORAGE_REDIS_PASSWORD}
-    }
-  }
-}
-
-# The session module's section: the login routes' settings.
-session {
-  # Every URL `POST /session/login` may accept as `redirect_to`, matched
-  # EXACTLY -- scheme, host, port, path and query all significant. Empty (the
-  # default) refuses every `redirect_to`, so leave it alone unless your login
-  # page actually posts one.
-  #
-  #   redirectAllowlist = ["https://app.example.com/welcome"]
-  #
-  # `http://` is accepted for loopback hosts only. With `session-store.domain`
-  # set above, an entry outside it fails boot rather than being silently
-  # ignored. The federation flow has a separate list per provider (see
-  # `core.federations` below).
-  redirectAllowlist = []
-  # POST /session/login's own attempt limit (brute-force protection), in
-  # windowMs (milliseconds), counted on the attempt counter
-  # (`adapters.attemptCounter`); kept in this layer so operators can tweak
-  # it. No rate limiter changes it. It does NOT govern OAuth endpoint rate
-  # limiting: the `rateLimiter` component
-  # (memoryRateLimiterModule or redisRateLimiterModule) reads its own section,
-  # `core-rate-limiter-memory` / `redis-rate-limiter` (with `windowSeconds`
-  # instead of `windowMs`). Switch via `adapters.rateLimiter = "memory" |
-  # "redis"` (see reference.conf). The Redis limiter's outage policy is its
-  # own key, `redis-rate-limiter.failMode` ("closed" by default;
-  # REDIS_RATE_LIMITER_FAIL_MODE sets it).
-  rateLimit {
-    login { windowMs = 900000, limit = 20 }
-  }
-}
-
-# The MFA routes' budget, 60 per 300 s, is config/reference.conf's, given to
-# both limiters so that switching `adapters.rateLimiter` keeps it. Change it
-# for the limiter this deployment wires, in its own section:
-#
-#   redis-rate-limiter.limits.mfa { limit = 30, windowSeconds = 300 }
-
-# The federations, in core's own section, keyed by the name each is reached
-# at (/session/oauth/federation/<name>). A key of one is bound to the
-# variable named after its path, CORE_FEDERATIONS_<NAME>_<KEY>. Each entry
-# names its `type`, and boot hands an enabled entry to the module that handles
-# that type: the template loads the `google` and `oidc` types, so an entry of
-# either type under any name is a federation of its own. An entry without a
-# `type`, enabled or not, refuses the boot, and so does an enabled entry of a
-# type no loaded module handles.
-core.federations {
-  # Template ships a Google federation declaration disabled-by-default.
-  # Operators enable + populate credentials via env vars. A second Google
-  # client is another entry with `type = "google"` and its own callbackURL.
-  google {
-    enabled = false
-    enabled = ${?CORE_FEDERATIONS_GOOGLE_ENABLED}
-    type = "google"
-    clientId = ${?CORE_FEDERATIONS_GOOGLE_CLIENT_ID}
-    clientSecret = ${?CORE_FEDERATIONS_GOOGLE_CLIENT_SECRET}
-    callbackURL = "http://localhost:3000/session/oauth/federation/google/callback"
-    callbackURL = ${?CORE_FEDERATIONS_GOOGLE_CALLBACK_URL}
-
-    # Every URL a `redirect_to` query parameter may name on
-    # /session/oauth/federation/google. Matching is EXACT — scheme, host, port,
-    # path, query and fragment all count — so list each landing page in full.
-    # There is no wildcard and no subdomain matching.
-    #
-    # An empty list refuses every `redirect_to`, which is the right setting for
-    # a deployment that does not use the parameter. It is NOT a way to allow
-    # everything: nothing falls back to accepting any http(s) URL, which would
-    # make this an open redirect.
-    #
-    # https is required, except for a loopback host (localhost, 127.0.0.0/8,
-    # [::1]) — that carve-out is what lets a local dev front-end and a native
-    # client on an ephemeral loopback listener work without a certificate. The
-    # port is still part of the match, so list the port the client binds.
-    #
-    #   redirectAllowlist = [
-    #     "https://app.example.com/welcome"
-    #     "http://localhost:5173/welcome"
-    #   ]
-    redirectAllowlist = []
-
-    # Cookie / session domain. When set, every non-loopback redirectAllowlist
-    # entry must be inside it, checked at boot — an entry outside it fails
-    # startup rather than sitting here looking effective.
-    # sessionDomain = ${?CORE_FEDERATIONS_GOOGLE_SESSION_DOMAIN}
-
-    # Post-callback bridge page. Required only if `redirect_to` is used at all:
-    # the browser lands here as `<authCallbackUrl>?redirect_to=<encoded>`.
-    # authCallbackUrl = ${?CORE_FEDERATIONS_GOOGLE_AUTH_CALLBACK_URL}
-
-    # Where the browser goes after a callback carrying no `redirect_to`.
-    # clientUrl = ${?CORE_FEDERATIONS_GOOGLE_CLIENT_URL}
-
-    # RFC 9207: Google always returns `iss` on the callback, so a callback
-    # without one is refused. `false` is the way out if Google ever stops
-    # sending it. It permits a missing `iss` only — one that is sent and is not
-    # Google's is refused either way.
-    # requireAuthorizationResponseIss = ${?CORE_FEDERATIONS_GOOGLE_REQUIRE_AUTHORIZATION_RESPONSE_ISS}
-
-    # Whether sign-in asks Google for a refresh token. Unset is "offline":
-    # every sign-in shows Google's consent screen, because Google issues a
-    # refresh token only there, and every session gets one that
-    # POST /oauth/federation/google/token can refresh with. "online" shows the
-    # consent screen on the first sign-in only and gets no refresh token at
-    # all — for a deployment that uses Google to sign in and nothing more.
-    accessType = ${?CORE_FEDERATIONS_GOOGLE_ACCESS_TYPE}
-  }
-
-  # Any OpenID Connect provider (Okta, Entra ID, Auth0, Keycloak, your own
-  # tenant) — `@o3co/auth-provider-federation-oidc`. Disabled by
-  # default; the env vars below switch this one instance on. The section
-  # name is the federation name: the browser starts at
-  # /session/oauth/federation/oidc and the identity handed to the Store is
-  # "oidc:<sub>". An identity the Store does not know is refused (401);
-  # nothing is provisioned. To broker to a second IdP, copy this block under
-  # another name (`okta { type = "oidc" ... }`) with its own callbackURL.
-  oidc {
-    enabled = false
-    enabled = ${?CORE_FEDERATIONS_OIDC_ENABLED}
-    type = "oidc"
-
-    # Issuer identifier, exactly as the IdP writes it into `iss`. Discovery
-    # runs at boot from <issuer>/.well-known/openid-configuration and a
-    # failure refuses boot. https only (plain http on localhost for dev).
-    issuer = ${?CORE_FEDERATIONS_OIDC_ISSUER}
-    clientId = ${?CORE_FEDERATIONS_OIDC_CLIENT_ID}
-    # client_secret_basic. For private_key_jwt drop clientSecret and set
-    # privateKey (a PEM PKCS#8 key, or { pem, kid, alg }) instead.
-    clientSecret = ${?CORE_FEDERATIONS_OIDC_CLIENT_SECRET}
-    callbackURL = "http://localhost:3000/session/oauth/federation/oidc/callback"
-    callbackURL = ${?CORE_FEDERATIONS_OIDC_CALLBACK_URL}
-    scopes = ["openid", "profile", "email"]
-
-    # Same rules as the Google block above: exact URLs, https except on a
-    # loopback host, and an empty list refuses every `redirect_to`.
-    redirectAllowlist = []
-    # sessionDomain, authCallbackUrl and clientUrl work as for Google.
-    #
-    # Hand-typed endpoints instead of discovery (the IdP's document is wrong
-    # or unreachable from this network):
-    #   discovery = false
-    #   endpoints { authorizationEndpoint = "...", tokenEndpoint = "...", jwksUri = "..." }
-  }
-}
-
-# The variables that set keys of the template's own modules, bound here, last,
-# so each wins over a value this file sets above it. Keep this block last.
-# config/reference.conf holds the defaults and binds the same variables.
-http {
-  port = ${?HTTP_PORT}
-  trustProxy = ${?HTTP_TRUST_PROXY}
-  cors.allowedOrigins = ${?HTTP_CORS_ALLOWED_ORIGINS}
-}
-redis-clients {
-  url = ${?REDIS_CLIENTS_URL}
-  password = ${?REDIS_CLIENTS_PASSWORD}
-  assumeNoEviction = ${?REDIS_CLIENTS_ASSUME_NO_EVICTION}
-}

package/templates/standalone/config/clients.yaml

@@ -1,4 +0,0 @@
-# Client definitions loaded via loadYamlMap into InMemoryClientRepository.
-# Add client entries here. See clients.yaml.example for format.
-# Per-deployment: `.gitignore` keeps this file out of git and `.dockerignore`
-# out of the image (#705).

package/templates/standalone/config/clients.yaml.example

@@ -1,118 +0,0 @@
-# Example client definitions loaded via loadYamlMap into InMemoryClientRepository.
-# Copy this file to clients.yaml and customize for your deployment.
-#
-# clients.yaml is per-deployment (#705): `.gitignore` keeps it out of git and
-# `.dockerignore` out of the image, and docker-compose.production.yml mounts it
-# as the secret `client_registry`. This example is the committed one.
-#
-# `tokenEndpointAuthMethod` is REQUIRED (RFC 6749 §2.3 / RFC 7591 §2):
-#   - "client_secret_basic": HTTP Basic Authorization header — recommended for confidential clients
-#   - "client_secret_post":  form-encoded body parameters
-#   - "private_key_jwt":     the client signs a JWT with its own private key
-#                            (RFC 7523 §2.2, #484) — register its public keys as
-#                            `jwks` (inline) or `jwksUri`, exactly one; no clientSecret
-#   - "none":                public client — no clientSecret; PKCE/S256 mandatory at /authorize
-#
-# Secret format (only for confidential clients — basic / post):
-#   - Bcrypt hash: "$2b$10$..."  <-- use this
-#   - Plain text: "my-secret"     <-- accepted, for local development only
-#
-# Generate a real one:
-#   SECRET=$(openssl rand -base64 32)
-#   node -e "require('bcrypt').hash(process.argv[1],10).then(console.log)" "$SECRET"
-# Give $SECRET to the client; put the hash in this file.
-#
-# #407: the schema accepts any non-empty string here, unlike `session.secret`
-# and the JWT signing secret, which have carried a 256-bit floor since #282.
-# That is deliberate — this field also holds a bcrypt hash, whose shape those
-# floors would reject — but it means NOTHING stops you from shipping
-# `clientSecret: "changeme"`. A client secret authenticates a confidential
-# client at the token endpoint; treat it as you would any other credential
-# and give it 256 bits of randomness.
-#
-# `firstParty` (#267): REQUIRED to be `true` for a client to use `/authorize`.
-#   `/authorize` mints a code as soon as the session is authenticated, with no
-#   consent step, so a forced top-level navigation from an attacker's page
-#   makes a logged-in user's browser mint one for whatever client is named.
-#   That is defensible for clients you operate and only for those. Mark a
-#   client `firstParty: true` only if you would be comfortable with it
-#   receiving the user's identity without the user being asked.
-#
-#   A client without it is refused at `/authorize`, as is one carrying an
-#   explicit `firstParty: false`. There is no opt-out: mark every client you
-#   operate before pointing it at `/authorize`.
-#
-# `allowPlainPkce` (#273): PKCE is mandatory for EVERY client — confidential
-#   ones included — and `S256` is the only method accepted. There is no
-#   server-wide setting that changes either half. This per-client flag is the
-#   one exception hatch, and only for the method: `allowPlainPkce: true` lets
-#   that one client use the RFC 7636 `plain` challenge, which stores the
-#   verifier itself as the challenge and so proves nothing against anyone who
-#   can read the authorization request. Set it only for a legacy client that
-#   genuinely cannot compute SHA-256, and treat it as a migration deadline.
-#
-# `allowExchangeOfTokensIssuedToOthers`: read only where the token-exchange
-#   module (@o3co/auth-provider-oauth-token-exchange) is installed, which this
-#   template does not do by default. Token exchange requires the caller to be
-#   an audience of the subject token by default: the token's `azp` is the
-#   client, or its `aud` contains it. `true` lets this one client exchange
-#   tokens issued to other clients (a gateway, an on-behalf-of service). Only
-#   a strict `true` counts.
-
-# A machine client that authenticates with a key pair (#484). Nothing here is
-# secret: the private half stays with the client, which signs an assertion
-# (iss = sub = client id, aud = the issuer or the token endpoint, exp within
-# an hour, a fresh jti) per token request. Rotating the key is a JWKS
-# publish when `jwksUri` is used. Needs the replay seen-set wired
-# (REPLAY_SEEN_SET_ADAPTER, on by default).
-#
-# orders-service:
-#   tokenEndpointAuthMethod: "private_key_jwt"
-#   jwksUri: "https://orders.example.com/.well-known/jwks.json"
-#   # or inline:
-#   # jwks:
-#   #   keys:
-#   #     - { kty: "EC", crv: "P-256", kid: "2026-09", x: "...", y: "..." }
-#   allowedGrantTypes: ["client_credentials"]
-#   allowedScopes: ["orders:read"]
-#   defaultScopes: ["orders:read"]
-#   allowedAudiences: ["https://api.example.com/orders"]
-
-my-app:
-  tokenEndpointAuthMethod: "client_secret_basic"
-  firstParty: true
-  clientSecret: "$2b$10$REPLACE_WITH_BCRYPT_HASH"
-  allowedRedirectUris:
-    - "http://localhost:3000/callback"
-  allowedScopes:
-    - "read"
-    - "write"
-  # What an omitted `scope` parameter grants (#396). Must be a subset of
-  # allowedScopes (checked at boot). Without this, a request that omits
-  # `scope` is refused with invalid_scope — the old behavior granted the
-  # ENTIRE allowlist, which made "forgot to send scope" the maximum grant.
-  # Declare what an unscoped request should mean, not the ceiling.
-  defaultScopes:
-    - "read"
-
-# Public client example (e.g., a single-page app or mobile app):
-# my-spa:
-#   tokenEndpointAuthMethod: "none"
-#   firstParty: true
-#   # clientSecret MUST be absent for "none" clients.
-#   allowedRedirectUris:
-#     - "https://app.example/callback"
-#   allowedScopes:
-#     - "openid"
-#     - "profile"
-
-# Legacy client that cannot compute SHA-256 (#273). Prefer fixing the client.
-# my-legacy-device:
-#   tokenEndpointAuthMethod: "client_secret_basic"
-#   firstParty: true
-#   clientSecret: "$2b$10$REPLACE_WITH_BCRYPT_HASH"
-#   allowPlainPkce: true
-#   allowedRedirectUris:
-#     - "https://legacy.example/callback"
-#   allowedScopes:
-#     - "openid"

package/templates/standalone/config/development.conf

@@ -1,17 +0,0 @@
-# Environment overlay for development.
-# Loaded when CONFIG_ENV (or NODE_ENV) is "development" — the default.
-# Values here override application.conf.
-#
-# Most values are controlled via environment variables (see the ${?VAR}
-# substitutions in application.conf and reference.conf). Override entries
-# here only when you need a fixed development-specific value that cannot come
-# from an environment variable.
-
-# The MFA key ring's development key: the MFA package's published sample key
-# (MFA_DEVELOPMENT_SAMPLE_KEY), which everyone holds. It stands in for
-# MFA_ENCRYPTION_KEY here: to use a key of your own in development, write it
-# in place of this one. It is accepted only where the configuration's name and
-# NODE_ENV, each where set, say development or test, and is refused under
-# `core.deployment.mode = "multi"`; boot warns while it is in use
-# (mfa_development_sample_key_in_use). Read only while MFA_MODE installs MFA.
-mfa.encryptionKeys = [{ key = "bzNjbzptZmE6ZGV2ZWxvcG1lbnQtc2FtcGxlLWtleSE=" }]

package/templates/standalone/config/mailpit.conf

@@ -1,13 +0,0 @@
-# Environment overlay for a development run whose mail goes to Mailpit
-# (docker-compose.mailpit.yml). Loaded when CONFIG_ENV is "mailpit".
-#
-# The template installs the sender that logs each code only where the
-# configuration is selected as "development", and the SMTP sender under any
-# other name. For development only; a deployment names its own relay.
-#
-# It does not include development.conf, whose one setting is the MFA
-# development sample key: the MFA package accepts that key only where every
-# environment name set says development or test, and this run is selected as
-# "mailpit". The key ring's first key is MFA_ENCRYPTION_KEY, as the MFA
-# package's reference.conf binds it: write a key of your own
-# (openssl rand -base64 32) into .env; without one the boot is refused.

package/templates/standalone/config/production.conf

@@ -1,15 +0,0 @@
-# Environment overlay for production.
-# Loaded when CONFIG_ENV (or NODE_ENV) is "production".
-# Values here override application.conf.
-#
-# Most production-sensitive values (SESSION_STORE_SECRET, the JWT signing key, REDIS
-# URLs, federation client secrets, etc.) should be supplied via environment
-# variables — see the ${?VAR} substitutions in application.conf and
-# reference.conf.
-#
-# The signing key is a key pair delivered as files
-# (KEY_STORE_LOCAL_PRIVATE_KEY_PATH / KEY_STORE_LOCAL_PUBLIC_KEY_PATH), which
-# docker-compose.production.yml mounts as compose secrets.
-#
-# Override entries here only when a value must be fixed per-environment rather
-# than per-deployment (e.g. feature flags turned on only in production).