7081221352
Add WS_TLS_CA_FILE and WS_TLS_REJECT_UNAUTHORIZED so the remote agent can trust internal PKI chains instead of failing with "unable to verify the first certificate". Apply the same TLS options to proxied HTTPS calls and document CA bundle mounting in compose and deploy READMEs. Co-authored-by: Cursor <cursoragent@cursor.com>
32 lines
1.6 KiB
Text
32 lines
1.6 KiB
Text
# =============================================================================
|
|
# StoreHealthAnalyzer Remote Agent — Environment
|
|
# Copy this file to `.env` (next to docker-compose.yml) and fill in the
|
|
# values. NEVER commit .env — the top-level .dockerignore already excludes
|
|
# it from the image and .gitignore excludes it from git.
|
|
# =============================================================================
|
|
|
|
# Websocket URL of the main StoreHealthAnalyzer server. Use `wss://` if
|
|
# the server is reverse-proxied through TLS; `ws://host:port` for direct.
|
|
# Leave any legacy `?token=...` query parameter off — the WS_TOKEN below is
|
|
# sent as an Authorization: Bearer header instead.
|
|
WS_URL=wss://storehealthanalyzer.example.com/ws
|
|
|
|
# Shared secret the main server accepts. Must match the WS_TOKEN configured
|
|
# on the server side. Generate a strong random value once and rotate it if
|
|
# you suspect it's been exposed.
|
|
WS_TOKEN=change_me_to_a_long_random_value
|
|
|
|
# --- TLS (only needed for wss:// with a corporate / private CA) -----------
|
|
#
|
|
# Preferred: provide your root + intermediate CA(s) as a single PEM bundle.
|
|
# Concatenate them if you have separate files:
|
|
# cat root-ca.pem intermediate-ca.pem > ca-bundle.pem
|
|
# Then mount the file into the container (see docker-compose.yml) and set:
|
|
# WS_TLS_CA_FILE=/certs/ca-bundle.pem
|
|
#
|
|
# Alternative: Node's built-in NODE_EXTRA_CA_CERTS also works and applies to
|
|
# both the websocket and proxied HTTPS calls:
|
|
# NODE_EXTRA_CA_CERTS=/certs/ca-bundle.pem
|
|
#
|
|
# Last resort only (trusted networks): disable verification entirely.
|
|
# WS_TLS_REJECT_UNAUTHORIZED=false
|