From 6efa8c6d0b793de7536d9a397aba041e0efa4fa8 Mon Sep 17 00:00:00 2001 From: Haksung Jang Date: Thu, 3 Sep 2026 11:36:31 +0900 Subject: [PATCH] Wire audit export and retention env vars into compose 11 vars documented in .env.example (audit-log export webhook batch size/lag/token/URL, audit hash-chain key, retention windows for audit logs / notifications / report downloads / webhook deliveries / Celery task-run records, and the pg_dump/psql subprocess timeout) were never referenced in x-backend-env, so setting them in .env had no effect on the running container. Adds them with defaults matching core/config.py. Part of the compose env-var wiring audit. --- docker-compose.dev.yml | 19 +++++++++++++++++++ docker-compose.yml | 19 +++++++++++++++++++ 2 files changed, 38 insertions(+) diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml index 815267e5..e5194f1e 100644 --- a/docker-compose.dev.yml +++ b/docker-compose.dev.yml @@ -304,6 +304,25 @@ x-backend-env: &backend-env PERMISSION_CACHE_TTL_SECONDS: ${PERMISSION_CACHE_TTL_SECONDS:-} PASSWORD_RESET_TOKEN_RETENTION_GRACE_DAYS: ${PASSWORD_RESET_TOKEN_RETENTION_GRACE_DAYS:-1} REFRESH_TOKEN_RETENTION_GRACE_DAYS: ${REFRESH_TOKEN_RETENTION_GRACE_DAYS:-1} + # compose-env-var wiring audit: the audit-log export webhook (batch size, + # lag, auth token, target URL), the audit hash-chain key, and various + # retention windows (audit log, notifications, report downloads, webhook + # deliveries, Celery task-run records) plus the pg_dump/psql subprocess + # timeout. Documented in .env.example but never listed in this anchor, so + # setting any of them in .env had no effect on the running container. + # Defaults match core/config.py exactly, so an unset .env changes nothing + # for an existing deployment. + AUDIT_EXPORT_BATCH_SIZE: ${AUDIT_EXPORT_BATCH_SIZE:-500} + AUDIT_EXPORT_LAG_SECONDS: ${AUDIT_EXPORT_LAG_SECONDS:-30} + AUDIT_EXPORT_TOKEN: ${AUDIT_EXPORT_TOKEN:-} + AUDIT_EXPORT_URL: ${AUDIT_EXPORT_URL:-} + AUDIT_HASH_KEY: ${AUDIT_HASH_KEY:-} + AUDIT_LOG_RETENTION_DAYS: ${AUDIT_LOG_RETENTION_DAYS:-90} + BACKUP_SUBPROCESS_TIMEOUT: ${BACKUP_SUBPROCESS_TIMEOUT:-3600} + NOTIFICATION_RETENTION_DAYS: ${NOTIFICATION_RETENTION_DAYS:-180} + REPORT_DOWNLOAD_RETENTION_DAYS: ${REPORT_DOWNLOAD_RETENTION_DAYS:-365} + TASK_RUN_RETENTION_DAYS: ${TASK_RUN_RETENTION_DAYS:-90} + WEBHOOK_DELIVERY_RETENTION_DAYS: ${WEBHOOK_DELIVERY_RETENTION_DAYS:-90} services: postgres: diff --git a/docker-compose.yml b/docker-compose.yml index c06ff21a..51d2434d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -398,6 +398,25 @@ x-backend-env: &backend-env PERMISSION_CACHE_TTL_SECONDS: ${PERMISSION_CACHE_TTL_SECONDS:-} PASSWORD_RESET_TOKEN_RETENTION_GRACE_DAYS: ${PASSWORD_RESET_TOKEN_RETENTION_GRACE_DAYS:-1} REFRESH_TOKEN_RETENTION_GRACE_DAYS: ${REFRESH_TOKEN_RETENTION_GRACE_DAYS:-1} + # compose-env-var wiring audit: the audit-log export webhook (batch size, + # lag, auth token, target URL), the audit hash-chain key, and various + # retention windows (audit log, notifications, report downloads, webhook + # deliveries, Celery task-run records) plus the pg_dump/psql subprocess + # timeout. Documented in .env.example but never listed in this anchor, so + # setting any of them in .env had no effect on the running container. + # Defaults match core/config.py exactly, so an unset .env changes nothing + # for an existing deployment. + AUDIT_EXPORT_BATCH_SIZE: ${AUDIT_EXPORT_BATCH_SIZE:-500} + AUDIT_EXPORT_LAG_SECONDS: ${AUDIT_EXPORT_LAG_SECONDS:-30} + AUDIT_EXPORT_TOKEN: ${AUDIT_EXPORT_TOKEN:-} + AUDIT_EXPORT_URL: ${AUDIT_EXPORT_URL:-} + AUDIT_HASH_KEY: ${AUDIT_HASH_KEY:-} + AUDIT_LOG_RETENTION_DAYS: ${AUDIT_LOG_RETENTION_DAYS:-90} + BACKUP_SUBPROCESS_TIMEOUT: ${BACKUP_SUBPROCESS_TIMEOUT:-3600} + NOTIFICATION_RETENTION_DAYS: ${NOTIFICATION_RETENTION_DAYS:-180} + REPORT_DOWNLOAD_RETENTION_DAYS: ${REPORT_DOWNLOAD_RETENTION_DAYS:-365} + TASK_RUN_RETENTION_DAYS: ${TASK_RUN_RETENTION_DAYS:-90} + WEBHOOK_DELIVERY_RETENTION_DAYS: ${WEBHOOK_DELIVERY_RETENTION_DAYS:-90} services: # ---------------------------------------------------------------------------