Martino Ferrari
51 lines
2.2 KiB
TOML
51 lines
2.2 KiB
TOML
[server]
|
|
listen = ":8080"
|
|
storage_dir = "./interfaces"
|
|
|
|
# ── Identity & access control ───────────────────────────────────────────────
|
|
# The end-user identity is read from a header set by a trusted authenticating
|
|
# reverse proxy. Leave trusted_user_header empty for unproxied/dev/LAN use.
|
|
# SECURITY: only enable this when the proxy strips any client-supplied value of
|
|
# this header, otherwise it can be spoofed.
|
|
trusted_user_header = "" # e.g. "X-Forwarded-User"
|
|
# Identity used when the trusted header is absent/empty. Empty = anonymous.
|
|
default_user = ""
|
|
|
|
# Role-based access through group memberships. Each [[groups]] block lists
|
|
# members by role; a user's effective global capability is the highest role
|
|
# across all their memberships, along this ladder:
|
|
# viewer < operator < logiceditor < auditor < admin
|
|
# Capabilities: operator+ may write signals; logiceditor+ may edit panel and
|
|
# control logic; auditor+ may view the audit log; admin may open the admin pane.
|
|
#
|
|
# The built-in "public" group is implicit (every user is a viewer of it). A
|
|
# config with NO roles assigned anywhere is fully open (everyone is admin), for
|
|
# trusted-LAN/dev use; assigning any role switches to strict mode where unlisted
|
|
# users are read-only viewers. Once changed at runtime via the admin pane,
|
|
# {storage_dir}/access.json supersedes the groups below.
|
|
#
|
|
# Groups may nest via "parent": a member of a parent group inherits its role on
|
|
# every descendant group too (unless overridden lower).
|
|
# [[groups]]
|
|
# name = "public"
|
|
# admins = ["alice"] # alice is a global admin
|
|
# [[groups]]
|
|
# name = "operations"
|
|
# operators = ["bob"]
|
|
# auditors = ["carol"]
|
|
# [[groups]]
|
|
# name = "engineers"
|
|
# parent = "operations" # bob inherits operator here
|
|
# logiceditors = ["dave"]
|
|
# viewers = ["erin"]
|
|
|
|
[datasource.epics]
|
|
enabled = true
|
|
ca_addr_list = "" # overrides EPICS_CA_ADDR_LIST if set
|
|
archive_url = "" # EPICS Archive Appliance base URL
|
|
channel_finder_url = "" # e.g. http://channelfinder:8080/ChannelFinder
|
|
auto_sync_filter = "" # e.g. area=StorageRing or tags=production
|
|
|
|
[datasource.synthetic]
|
|
enabled = true
|