Add deployment

2026-08-05 00:26:20 +08:00
parent 9e88ff6113
commit 2a3ef62a7d
86 changed files with 2320 additions and 174 deletions
@@ -0,0 +1,70 @@
+# ---- image coordinates ----
+REGISTRY=gitea.example.com/vigilcare
+IMAGE_TAG=v1.0.0
+
+# ---- exposed ports on the production host ----
+API_PORT=5270
+GATEWAY_PORT=5081
+DASHBOARD_PORT=8080
+DASHBOARD_ORIGIN=https://vigilcare.example.com
+
+# ---- external PostgreSQL ----
+# Runtime (DML-only) connection used by the API container.
+PG_CONNECTION=Host=pg.internal;Port=5432;Database=vigilcare;Username=vigilcare_app;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false
+# DDL-privileged connection used ONLY by the EF migration bundle (Step 6 / CD migrate job).
+# Never put this credential in the API container environment.
+PG_CONNECTION_DDL=Host=pg.internal;Port=5432;Database=vigilcare;Username=vigilcare_migrator;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false
+GATEWAY_PG_CONNECTION=Host=pg.internal;Port=5432;Database=vigilcare_ward;Username=vigilcare_app;Password=CHANGE_ME;SSL Mode=Require
+
+# ---- external Redis ----
+REDIS_CONNECTION=redis.internal:6379,password=CHANGE_ME,ssl=True,abortConnect=false
+GATEWAY_REDIS_CONNECTION=redis.internal:6379,password=CHANGE_ME,ssl=True,abortConnect=false,defaultDatabase=1
+
+# ---- external Seq ----
+SEQ_URL=https://seq.internal
+SEQ_API_KEY=CHANGE_ME
+
+# ---- external Kafka ----
+KAFKA_BOOTSTRAP=kafka1.internal:9093,kafka2.internal:9093,kafka3.internal:9093
+KAFKA_REPLICATION_FACTOR=3
+KAFKA_SECURITY_PROTOCOL=SaslSsl
+KAFKA_SASL_MECHANISM=ScramSha512
+KAFKA_SASL_USERNAME=vigilcare
+KAFKA_SASL_PASSWORD=CHANGE_ME
+
+# ---- external Elasticsearch ----
+ES_URI=https://es.internal:9200
+ES_API_KEY=CHANGE_ME
+# or ES_USERNAME / ES_PASSWORD
+
+# ---- external RabbitMQ ----
+RABBITMQ_HOST=rabbit.internal
+RABBITMQ_PORT=5671
+RABBITMQ_USERNAME=vigilcare
+RABBITMQ_PASSWORD=CHANGE_ME
+RABBITMQ_USE_SSL=true
+GATEWAY_RABBITMQ_HOST=rabbit.internal
+GATEWAY_RABBITMQ_PORT=5671
+GATEWAY_RABBITMQ_USERNAME=vigilcare_gw
+GATEWAY_RABBITMQ_PASSWORD=CHANGE_ME
+GATEWAY_RABBITMQ_USE_SSL=true
+
+# ---- external MinIO ----
+MINIO_ENDPOINT=minio.internal:9000
+MINIO_ACCESS_KEY=CHANGE_ME
+MINIO_SECRET_KEY=CHANGE_ME
+MINIO_USE_SSL=true
+
+# ---- application secrets (generate with: openssl rand -base64 48) ----
+JWT_SIGNING_KEY=CHANGE_ME_MINIMUM_32_BYTES
+# WARNING: rotating PHI_SEARCH_TOKEN_KEY invalidates every stored patient
+# search token. See docs/ops/phi-encryption-runbook.md before changing it.
+PHI_SEARCH_TOKEN_KEY=CHANGE_ME_32_BYTES
+GATEWAY_API_KEY=CHANGE_ME
+FHIR_API_KEY=CHANGE_ME
+GATEWAY_JWT_SIGNING_KEY=CHANGE_ME_MINIMUM_32_BYTES
+
+# ---- gateway identity ----
+GATEWAY_ID=00000000-0000-0000-0000-000000000000
+GATEWAY_SITE_ID=00000000-0000-0000-0000-000000000000
+GATEWAY_DEPARTMENT=ICU