<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>cavaliba.com – Configuration</title>
    <link>https://cavaliba.com/docs/800_advanced_configuration/</link>
    <description>Recent content in Configuration on cavaliba.com</description>
    <generator>Hugo -- gohugo.io</generator>
    <language>en-us</language>
    
	  <atom:link href="https://cavaliba.com/docs/800_advanced_configuration/index.xml" rel="self" type="application/rss+xml" />
    
    
      
        
      
    
    
    <item>
      <title>Basic Authentication</title>
      <link>https://cavaliba.com/docs/800_advanced_configuration/authentication_basic/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>https://cavaliba.com/docs/800_advanced_configuration/authentication_basic/</guid>
      <description>
        
        
        &lt;p&gt;Basic Authentication is an &lt;strong&gt;external&lt;/strong&gt; authentication mode. It is not performed by the Cavaliba application itself. A front Web server is in charge of this authentication and will set standard HTTP Authentication headers, passed to Cavaliba.&lt;/p&gt;
&lt;p&gt;This mode, like the Local Authentication mode, is suitable for small deployment, with no advanced authentication and access management features. User management is to be performed both externally and inside Cavaliba to map external users to Cavaliba users.&lt;/p&gt;
&lt;h2&gt;Internal Cavaliba Web Server (NGINX)&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;internal-cavaliba-web-server-nginx&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#internal-cavaliba-web-server-nginx&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Basic Authentication can be configured at the Cavaliba container with the NGINX Web server.&lt;/p&gt;
&lt;p&gt;Steps:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;edit the nginx.conf file next to the docker-compose.yml, to uncomment basic authentication lines&lt;/li&gt;
&lt;li&gt;create a standard htpassword file (htpasswd)&lt;/li&gt;
&lt;li&gt;edit the docker-compose.yml to uncomment the line mounting this htpassword file inside the nginx container&lt;/li&gt;
&lt;li&gt;in .env configure CAVALIBA_AUTH_MODE=basic&lt;/li&gt;
&lt;li&gt;restart docker containers&lt;/li&gt;
&lt;li&gt;populate / manage the htpasswd file on the server&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;You may then edit and update dynamically the htpasswd file, to add or remove users, change their password, etc.&lt;/p&gt;
&lt;h2&gt;External Web-Server / Reverse-PRoxy&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;external-web-server--reverse-proxy&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#external-web-server--reverse-proxy&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Basic Authentication can also be configured at any upstream Web server / Reverse-Proxy which may be set up before reaching Cavaliba Application.&lt;/p&gt;
&lt;p&gt;This Reverse-Proxy &lt;strong&gt;must&lt;/strong&gt; set the HTTP Authentication Header to let Cavaliba obtain the user&amp;rsquo;s login value.&lt;/p&gt;
&lt;h2&gt;Cavaliba users&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;cavaliba-users&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#cavaliba-users&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Don&amp;rsquo;t forget to always map external users (in the htpasswd), to users objects in the Cavaliba User model with the same login value. Add group membership, roles, permissions, etc.&lt;/p&gt;

      </description>
    </item>
    
    <item>
      <title>Forced Authentication</title>
      <link>https://cavaliba.com/docs/800_advanced_configuration/authentication_forced/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>https://cavaliba.com/docs/800_advanced_configuration/authentication_forced/</guid>
      <description>
        
        
        &lt;p&gt;Forced authentication means &lt;strong&gt;no authentication&lt;/strong&gt;. No authentication is performed and all connections are mapped to a single internal Cavaliba user. It is indented for developpment purpose, or Robinson Crusoe on a desert island.&lt;/p&gt;
&lt;p&gt;Don&amp;rsquo;t use in production, or even in QUA / Tests, on a shared network.&lt;/p&gt;

      </description>
    </item>
    
    <item>
      <title>LDAP Authentication</title>
      <link>https://cavaliba.com/docs/800_advanced_configuration/authentication_ldap/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>https://cavaliba.com/docs/800_advanced_configuration/authentication_ldap/</guid>
      <description>
        
        
        &lt;p&gt;Cavaliba doesn&amp;rsquo;t provide out of the box LDAP authentication.&lt;/p&gt;
&lt;p&gt;See SAML/OIDC for indirect LDAP Authentication through an ODIC/SAML local Identity Provider such as Keycloak.&lt;/p&gt;

      </description>
    </item>
    
    <item>
      <title>Local Authentication</title>
      <link>https://cavaliba.com/docs/800_advanced_configuration/authentication_local/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>https://cavaliba.com/docs/800_advanced_configuration/authentication_local/</guid>
      <description>
        
        
        &lt;p&gt;This is the default mode, which is enabled after a fresh install.&lt;/p&gt;
&lt;p&gt;This mode is suitable for  small deployment with a limited number of users, and little to no need for advanced features such as multi-factor authentication, registration/sign-up forms, password loss/change self-service, etc.&lt;/p&gt;
&lt;p&gt;User accounts (login/password) are configured manually and directly inside in Cavaliba by an administrator.&lt;/p&gt;
&lt;p&gt;Sign-in/Sign-out Web forms are provided by Cavaliba.&lt;/p&gt;
&lt;h2&gt;Steps to configure this mode&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;steps-to-configure-this-mode&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#steps-to-configure-this-mode&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;ul&gt;
&lt;li&gt;remove/comment OAUTH configuration blocs in nginx.conf and docker-compose.yml&lt;/li&gt;
&lt;li&gt;in .env configure CAVALIBA_AUTH_MODE=local&lt;/li&gt;
&lt;li&gt;restart docker containers&lt;/li&gt;
&lt;li&gt;login with admin or other provisionned account in Cavaliba&lt;/li&gt;
&lt;/ul&gt;
&lt;h2&gt;How does-it work&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;how-does-it-work&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#how-does-it-work&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;In Local Authentication mode, users are authenticated ny the Django App Framework. They must exist in the Django auth structure, which is basically a specific DB table. Login, Password are the sole mandatory attributes for the purpose of authenticating a user.&lt;/p&gt;
&lt;p&gt;Then, the user must also in the Cavaliba Data Model, with the same login. This model is common to all authentication modes. It defines who is the user (extended attributes, group membership, directory pages), if and what he can do when logged-in,  what notifications he will receive, etc.&lt;/p&gt;
&lt;h2&gt;Add a user&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;add-a-user&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#add-a-user&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Manually from Cavaliba  :&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;open the DB Admin tool from Cavaliba main menu&lt;/li&gt;
&lt;li&gt;select the django user table&lt;/li&gt;
&lt;li&gt;clic the &amp;ldquo;add user&amp;rdquo; top-right button and fill-in the form : login, password&lt;/li&gt;
&lt;li&gt;get back to cavaliba&lt;/li&gt;
&lt;li&gt;go to the Cavaliba User module&lt;/li&gt;
&lt;li&gt;add the user (same login) with extended informations, group membership, etc.&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;CLI / Shell:&lt;/p&gt;
&lt;pre&gt;&lt;code&gt; $ cd cavaliba/
 $ docker exec -it cavaliba_app python manage.py shell
  &amp;gt;&amp;gt;&amp;gt; from django.contrib.auth.models import User
  &amp;gt;&amp;gt;&amp;gt; user = User.objects.create_user(&amp;quot;john&amp;quot;, &amp;quot;lennon@thebeatles.com&amp;quot;, &amp;quot;johnpassword&amp;quot;)
&lt;/code&gt;&lt;/pre&gt;
&lt;h2&gt;Suspend / Remove a user&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;suspend--remove-a-user&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#suspend--remove-a-user&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;ul&gt;
&lt;li&gt;open the DB Admin tool from Cavaliba main menu&lt;/li&gt;
&lt;li&gt;select the django user table&lt;/li&gt;
&lt;li&gt;select the appropriate user&lt;/li&gt;
&lt;li&gt;edit the form, disable / remove and save&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;As this point, the user can&amp;rsquo;t sign-in to cavaliba. But he still exists in the Data Model and can receive notifications (Sirene).&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;go to the Cavaliba User module&lt;/li&gt;
&lt;li&gt;select the user (same login) and disable/remove&lt;/li&gt;
&lt;/ul&gt;
&lt;h2&gt;Change a user&amp;rsquo;s password&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;change-a-users-password&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#change-a-users-password&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Web interface :&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;open the DB Admin tool from Cavaliba main menu&lt;/li&gt;
&lt;li&gt;select the django user table&lt;/li&gt;
&lt;li&gt;select the appropriate user&lt;/li&gt;
&lt;li&gt;use the change password tool&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;CLI / Shell&lt;/p&gt;
&lt;pre&gt;&lt;code&gt; $ cd cavaliba/
 $ docker exec -it cavaliba_app python manage.py changepassword LOGIN
&lt;/code&gt;&lt;/pre&gt;

      </description>
    </item>
    
    <item>
      <title>SAML/OIDC Authentication</title>
      <link>https://cavaliba.com/docs/800_advanced_configuration/authentication_saml_oidc/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>https://cavaliba.com/docs/800_advanced_configuration/authentication_saml_oidc/</guid>
      <description>
        
        
        &lt;p&gt;SAML/OIDC  Authentication is an &lt;strong&gt;external&lt;/strong&gt; authentication mode. It is called OAUTH2 in Cavaliba.&lt;/p&gt;
&lt;p&gt;It is performed by a companion component, namely &lt;strong&gt;oauth2_proxy&lt;/strong&gt;, which is included in Cavaliba as an additional container, ready to be started and configured.&lt;/p&gt;
&lt;p&gt;This model is suitable for modern/large scale deployment. It offloads all the access / authentication process to an external Authentication server (IdP, Identity Provider). It may provide Multi-factor strong authentication, and many user self-service to manage their account and credentials depending on the IDP.&lt;/p&gt;
&lt;p&gt;Identity Providers are external services such as Keycloak, OKTA, Microsoft Azure AD and numerous other providers.&lt;/p&gt;
&lt;h2&gt;steps to configure&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;steps-to-configure&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#steps-to-configure&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Identity Provider&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Register your Cavaliba deployement to your IDP (identity provider)&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;Provision users in advance&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;if coming from other AUTH MODE such as local, create users matching users in your IDP, with appropriate permissions&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;System &amp;amp; Docker&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;in the .env docker file, configure the IDP parameters (client id, secret, URLs)&lt;/li&gt;
&lt;li&gt;in the .env docker file, configure CAVALIBA_AUTH_MODE=oauth2&lt;/li&gt;
&lt;li&gt;in docker-compose.yaml,  uncomment the oauth2_proxy container bloc&lt;/li&gt;
&lt;li&gt;in nginx.conf, uncomment the oauth2 configuration blocs ; comment basic authentication if any&lt;/li&gt;
&lt;li&gt;restart docker containers&lt;/li&gt;
&lt;/ul&gt;
&lt;h2&gt;Setup a local Keycloak IDP&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;setup-a-local-keycloak-idp&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#setup-a-local-keycloak-idp&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;TBD - start a local Keycloak container, configure User directory, authentication workflows. Register Cavaliba as a a new Service Provider for this IDP.&lt;/p&gt;
&lt;h2&gt;Bonus : LDAP Authentication&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;bonus--ldap-authentication&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#bonus--ldap-authentication&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;LDAP authentication is a mean to authenticate users against a central  Directory like Openldap, Lemonldap or Active Directory.&lt;/p&gt;
&lt;p&gt;Although not immediately available in Cavaliba it can be set up with the OAUTH2 mode requesting a local Identity Provider (like Keycloak) which in turn, queries an LDAP Directory.&lt;/p&gt;

      </description>
    </item>
    
    <item>
      <title>Docker configuration</title>
      <link>https://cavaliba.com/docs/800_advanced_configuration/docker_env/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>https://cavaliba.com/docs/800_advanced_configuration/docker_env/</guid>
      <description>
        
        
        &lt;p&gt;Thoe &lt;code&gt;.env&lt;/code&gt;docker file holds several important options.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;CAVALIBA_DOCKER_IMAGE&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_DOCKER_IMAGE=cavaliba/cavaliba:3.10
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;Name of the docker registry, docker image and version for the Cavaliba Application. The default value displayed above queries Docker Hub, for the cavaliba repository, cavaliba image object, with a version 3.10. You can use any public/private image repository that can be accessed from your docker host.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Cavaliba Authentication and built-in Admin account&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;# local, basic, oauth2, forced
CAVALIBA_AUTH_MODE=local
# if forced mode
CAVALIBA_FORCE_LOGIN=admin
# admin built-in account
CAVALIBA_ADMIN_PASSWORD=change_again
CAVALIBA_ADMIN_EMAIL=admin@mydomain.com

# UI session duration max (default 3600 seconds)
CAVALIBA_SESSION_DURATION=36000
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;Internal Built-in account used to access Cavaliba Web Application and DB web admin tool. It is created during the first launch of Cavaliba,  and re-creation is attempted at every new launch.&lt;/p&gt;
&lt;p&gt;The login is &lt;code&gt;admin&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;To change the password, use the DB web admin tool. You can also use the django manage tool with the createsuperuser command.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;CAVALIBA_PORT&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_PORT=8000
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;Network port the cavaliba nginx container will expose and listen to on the Host.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;CAVALIBA_CSRF_TRUSTED_ORIGINS&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_CSRF_TRUSTED_ORIGINS=&amp;quot;http://127.0.0.1:8000 https://mycavaliba.mydomain.com&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;String and blank separated list of schema, FQDN and port for  hosts hosting the Cavaliba Application. CSRF protection will be valid only for the listed entries.&lt;/p&gt;
&lt;p&gt;You &lt;strong&gt;must&lt;/strong&gt; set this entry according to your environment.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;CAVALIBA_ALLOWED_HOSTS&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_ALLOWED_HOSTS=&amp;quot;localhost 127.0.0.1 *&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;From Django documentation: &lt;em&gt;A list of strings representing the host/domain names that this Django site can serve. This is a security measure to prevent HTTP Host header attacks, which are possible even under many seemingly-safe web server configurations.&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;CAVALIBA_SECRET_KEY&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_SECRET_KEY=changeme_with_a_long_string
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;Set a random long string to protect session cookies used by Cavaliba. If you change the value and restart Cavaliba, all users will be signed-out of the application.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;CAVALIBA_CIPHER_KEY&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt; CAVALIBA_CIPHER_KEY=&amp;quot;a_very_secret_string&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;The secret key to encrypt sensitive information in the Cavaliba Database. If you lose or change this value, previous content from the database will be lost.&lt;/p&gt;
&lt;p&gt;Use case: SMS content for the SMS_Send feature in Sirene App.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;CAVALIBA_TENANT&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_TENANT=cavaliba
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;The name/prefix of the docker objects (container name, docker network) created whden starting cavaliba. Use one value per docker-compose.yml file to start several simultaneous Cavaliba instance on a same host. Don&amp;rsquo;t forget to also select a different network listening port for each. Each instance is isolated on a different docker bridge.&lt;/p&gt;
&lt;p&gt;Change this value if you plan to host several Cavaliba isolated deployment on the same Host/VM.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;DB options&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_DB_ENGINE=django.db.backends.mysql
CAVALIBA_DB_HOST=cavaliba_db
CAVALIBA_DB_PORT=3306
CAVALIBA_DB_DATABASE=cavaliba
CAVALIBA_DB_USER=cavaliba
CAVALIBA_DB_PASSWORD=changeme_please
CAVALIBA_DB_ROOT_PASSWORD=changeme_please_also
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;By default, Cavaliba is provided with an internal MariaDB database instance (container), dedicated to the Cavaliba application. This parameters define the important values to create the DB and connect the Application.&lt;/p&gt;
&lt;p&gt;The &lt;strong&gt;CAVALIBA_DB_HOST&lt;/strong&gt; is the docker DNS name of the database server. If you decide to use an external DB server (either physical/VM or cloud service) you need to replace with the exact hostname / FQDN. For single or multiple Cavaliba instance in docker mode, you don&amp;rsquo;t need to change this value.&lt;/p&gt;
&lt;p&gt;If the MariaDB is dedicated to Cavaliba (as with the the provided configuration), there is no issue to having identical values for PASSWORD and ROOT_PASSWORD.&lt;/p&gt;
&lt;p&gt;For the moment, only MariaDB/MySQL is supported. PostGreSQL may be added later.&lt;/p&gt;
&lt;p&gt;&lt;strong&gt;Identity Federation options&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;OAUTH2_PROXY_PROVIDER=&amp;quot;oidc&amp;quot;
OAUTH2_PROXY_PROVIDER_DISPLAY_NAME=&amp;quot;&amp;quot;
OAUTH2_PROXY_OIDC_ISSUER_URL=&amp;quot;&amp;quot;
OAUTH2_PROXY_CLIENT_ID=&amp;quot;&amp;quot;
OAUTH2_PROXY_CLIENT_SECRET=&amp;quot;&amp;quot;
OAUTH2_PROXY_COOKIE_SECRET=&amp;quot;&amp;quot;
OAUTH2_PROXY_REDIRECT_URL=&amp;quot;&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;&lt;strong&gt;Email/SMTP configurations&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_EMAIL_HOST=localhost
CAVALIBA_EMAIL_PORT=25
# uncomment if authentication needed
#CAVALIBA_EMAIL_USER=noreply
#CAVALIBA_EMAIL_PASSWORD=changeme
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;&lt;strong&gt;SMS configurations&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_SMS_URL=&amp;quot;https://my.sms.provider.com/api/&amp;quot;
CAVALIBA_SMS_LOGIN=&amp;quot;my_sms_account&amp;quot;
CAVALIBA_SMS_PASSWORD=&amp;quot;changeme&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;&lt;strong&gt;Cache&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;CAVALIBA_CACHE_DEFAULT_URL=&amp;quot;redis://cavaliba_redis:6379&amp;quot;
CAVALIBA_CACHE_SESSION_URL=&amp;quot;redis://cavaliba_redis:6379&amp;quot;
CAVALIBA_CELERY_BROKER_URL=&amp;quot;redis://cavaliba_redis:6379&amp;quot;
CAVALIBA_CELERY_RESULT_BACKEND=&amp;quot;redis://cavaliba_redis:6379&amp;quot;
&lt;/code&gt;&lt;/pre&gt;
&lt;p&gt;&lt;strong&gt;Other&lt;/strong&gt;&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;# keep 0 in PRODUCTION
CAVALIBA_DEBUG=0
CAVALIBA_DEBUG_IP=&amp;quot;127.0.0.1 172.19.0.1&amp;quot;
&lt;/code&gt;&lt;/pre&gt;

      </description>
    </item>
    
    <item>
      <title>Reverse-Proxy and TLS/SSL</title>
      <link>https://cavaliba.com/docs/800_advanced_configuration/tls_ssl/</link>
      <pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate>
      
      <guid>https://cavaliba.com/docs/800_advanced_configuration/tls_ssl/</guid>
      <description>
        
        
        &lt;p&gt;You should setup a TLS/SSL reverse-proxy in front of your Cavaliba docker deployment.&lt;/p&gt;
&lt;p&gt;A reverse-proxy would perform the following tasks:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;offload (terminate) HTTPS SSL/TLS user connections and handle certificate configuration and renewal&lt;/li&gt;
&lt;li&gt;filter user source IP addresses if restricted network exposure is needed&lt;/li&gt;
&lt;li&gt;perform HTTP Basic/Digest user authentication if this auth mode is selected for Cavaliba&lt;/li&gt;
&lt;li&gt;produce log and audit-trail&lt;/li&gt;
&lt;li&gt;on large / fault-tolerant setups, perfom user trafic load-balancing accross multiple Cavaliba nodes&lt;/li&gt;
&lt;li&gt;display a Maintenance/Sorry page if it detects that cavalliba stack is down&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;You may use an enterprise wide / netork managed load-balancer and reverse-proxy. You can also deploy a small NGINX or HA-PROXY component on your Cavaliba host virtual machine.&lt;/p&gt;
&lt;h2&gt;Node Healthcheck / status&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;node-healthcheck--status&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#node-healthcheck--status&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;An external reverse-proxy or load-balancer should remove a failed node from its server pool and stop sending user traffic to failed nodes.&lt;/p&gt;
&lt;p&gt;Additionally, a monitoring tool should check the availability of services.&lt;/p&gt;
&lt;p&gt;Basic healthcheck can be implemented by verifying a simple TCP on http endpoint (TCP can connect). you can also check an HTTP 200 response.&lt;/p&gt;
&lt;p&gt;Better, you may implement a deeper healthcheck on the  &lt;strong&gt;/status/&lt;/strong&gt; page and check for an &amp;ldquo;OK&amp;rdquo; answer from Cavaliba. This check confirms that the application node is alive and healthy.&lt;/p&gt;
&lt;pre&gt;&lt;code&gt;curl http://cavaliba/status/
OK
&lt;/code&gt;&lt;/pre&gt;
&lt;h2&gt;Example : minimal NGINX / Let&amp;rsquo;s Encrypt SSL/TLS reverse-proxy&lt;span class=&#34;hx-absolute -hx-mt-20&#34; id=&#34;example--minimal-nginx--lets-encrypt-ssltls-reverse-proxy&#34;&gt;&lt;/span&gt;
    &lt;a href=&#34;#example--minimal-nginx--lets-encrypt-ssltls-reverse-proxy&#34; class=&#34;subheading-anchor&#34; aria-label=&#34;Permalink for this section&#34;&gt;&lt;/a&gt;&lt;/h2&gt;&lt;p&gt;Setup&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;$ sudo apt install nginx apache2-utils certbot python3-certbot-nginx
$ sudo certbot -n --agree-tos --email mycontact@mydomain.com --nginx -d mycavaliba.mydomain.com
$ sudo systemctl enable nginx&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;p&gt;Configuration&lt;/p&gt;
&lt;div class=&#34;hextra-code-block hx-relative hx-mt-6 first:hx-mt-0 hx-group/code&#34;&gt;

&lt;div&gt;&lt;pre&gt;&lt;code&gt;$ sudo cat /etc/nginx/sites-enabled/default

	upstream cavaliba {
	  keepalive 60;
	  server 127.0.0.1:8000;
	}
	server
	{
	    if ($host = mycavaliba.mydomain.com ) {
	        return 301 https://$host$request_uri;
	    } # managed by Certbot
	    listen 80 default_server;
	    server_name mycavaliba.mydomain.com;
	    return 404; # managed by Certbot
	}
	server
	{
	    server_name mycavaliba.mydomain.com;
	    listen 443 ssl; # managed by Certbot
	    ssl_certificate /etc/letsencrypt/live/mycavaliba.mydomain.com/fullchain.pem; # managed by Certbot
	    ssl_certificate_key /etc/letsencrypt/live/mycavaliba.mydomain.com/privkey.pem; # managed by Certbot
	    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
	    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

	    # -------------
	    location /
	    {
	        proxy_set_header Host $http_host;
	        proxy_set_header X-Forwarded-Host $host;
	        proxy_set_header X-Forwarded-Server $host;
	        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	        #rewrite ^/cavaliba/(.*)$  /$1  break;
	        proxy_pass http://cavaliba;
	        proxy_http_version 1.1;
	        proxy_set_header Connection &amp;#34;&amp;#34;;
	    }
	}&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;div class=&#34;hextra-code-copy-btn-container hx-opacity-0 hx-transition group-hover/code:hx-opacity-100 hx-flex hx-gap-1 hx-absolute hx-m-[11px] hx-right-0 hx-top-0&#34;&gt;
  &lt;button
    class=&#34;hextra-code-copy-btn hx-group/copybtn hx-transition-all active:hx-opacity-50 hx-bg-primary-700/5 hx-border hx-border-black/5 hx-text-gray-600 hover:hx-text-gray-900 hx-rounded-md hx-p-1.5 dark:hx-bg-primary-300/10 dark:hx-border-white/10 dark:hx-text-gray-400 dark:hover:hx-text-gray-50&#34;
    title=&#34;Copy code&#34;
  &gt;
    &lt;div class=&#34;copy-icon group-[.copied]/copybtn:hx-hidden hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
    &lt;div class=&#34;success-icon hx-hidden group-[.copied]/copybtn:hx-block hx-pointer-events-none hx-h-4 hx-w-4&#34;&gt;&lt;/div&gt;
  &lt;/button&gt;
&lt;/div&gt;
&lt;/div&gt;

      </description>
    </item>
    
  </channel>
</rss>
