a3aded110c
A Docker Compose stack that runs the deployed images (quay.io/schulcloudverbund/*, thr theme, tag 33.40 — the versions schulcloud-thueringen.de reports) rather than a rebuild of main, so what we develop against is the deployed artefact. It exists to produce the states we can otherwise only observe read-only: log in as the teacher, grade, then read it back the way the MCP server does. Faithful where it matters and honest where it isn't: - Feature flags in env/api.env are a replay of GET /api/v3/config/public from the live instance, not a hand-picked set; instance identity mirrors the thr group_vars from dof_app_deploy. - The proxy is generated from the deployment's own ingress table (scripts/gen-proxy-conf.py) so the legacy-client / SPA / API path split matches production; getting it wrong tests a different application. - Valkey runs in `single` mode so the JWT whitelist expires sessions the way production does, rather than the in-memory shortcut that hides it. - No external OAuth / Schulportal login (excluded by request and not reproducible locally), no BigBlueButton; each divergence is marked at the line it affects. Everything binds to 127.0.0.1 and uses the upstream dev credentials, which are public. Profiles keep the heavy pieces opt-in: `tools` adds Etherpad/H5P/tldraw/ Collabora, `av` adds ClamAV, `preview` adds thumbnailing. seed.sh loads the upstream demo school (the same call the deployment's init job makes) and registers MinIO as the legacy storage provider, which has no seed data on purpose. The demo data already contains the grading states that are hard to obtain from the real account — a feedback-only grade and a 100% one — which is what surfaced the past-due submitted-text scrape gap. One config finding baked in: file-storage and h5p validate a token's issuer/audience against JWT_DOMAIN (default "localhost"), while the API stamps SC_DOMAIN; without keeping them equal, the homework page's file lookups 401. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
96 lines
4.0 KiB
Bash
96 lines
4.0 KiB
Bash
# The schulcloud-server API app (apps/server.app).
|
|
#
|
|
# The FEATURE_* block below is not hand-picked: it is a replay of
|
|
# GET /api/v3/config/public from the live schulcloud-thueringen.de, so the local
|
|
# instance exposes the same surface to students that the real one does.
|
|
# Regenerate with ./scripts/sync-feature-flags.sh.
|
|
|
|
PORT=3030
|
|
|
|
# Internal service addresses (compose DNS), not the browser-facing origin.
|
|
API_HOST=http://api:3030/api
|
|
FILES_STORAGE__SERVICE_BASE_URL=http://file-storage:4444
|
|
LICENSE_SUMMARY_URL=http://api:3030/api/licenses/summary
|
|
ROOM_MEMBER_INFO_URL=http://api:3030/api/rooms/member-info
|
|
|
|
ALERT_STATUS_URL=https://status.schulcloud-thueringen.de/
|
|
CALENDAR_SERVICE_ENABLED=false
|
|
NEST_LOG_LEVEL=info
|
|
|
|
# Etherpad (see ../etherpad/APIKEY.txt)
|
|
ETHERPAD__URI=http://etherpad:9001/api/1
|
|
ETHERPAD__PAD_URI=http://localhost:4400/etherpad/p
|
|
ETHERPAD__API_KEY=381d67e6347d235ac9446da3ea10a82efd6f8ae09fa2e90efeda80f82feeb4fd
|
|
|
|
# tldraw + admin API
|
|
TLDRAW__WEBSOCKET_URL=ws://localhost:4400/tldraw-server
|
|
TLDRAW_ADMIN_API_CLIENT__BASE_URL=http://tldraw-server:3349
|
|
TLDRAW_ADMIN_API_CLIENT__API_KEY=tldraw-admin-key
|
|
ADMIN_API__ALLOWED_API_KEYS=thisisasupersecureapikeythatisabsolutelysave
|
|
|
|
# Teacher/student visibility, as configured for thr.
|
|
TEACHER_STUDENT_VISIBILITY__IS_CONFIGURABLE=false
|
|
TEACHER_STUDENT_VISIBILITY__IS_ENABLED_BY_DEFAULT=true
|
|
TEACHER_STUDENT_VISIBILITY__IS_VISIBLE=false
|
|
|
|
# --- feature flags, mirrored from the live instance ----------------------
|
|
FEATURE_ADMINISTRATE_ROOMS_ENABLED=true
|
|
FEATURE_AI_TUTOR_ENABLED=false
|
|
FEATURE_ALLOW_INSECURE_LDAP_URL_ENABLED=false
|
|
FEATURE_BOARD_LAYOUT_ENABLED=true
|
|
FEATURE_BOARD_READERS_CAN_EDIT_TOGGLE=true
|
|
FEATURE_COLUMN_BOARD_COLLABORATIVE_TEXT_EDITOR_ENABLED=true
|
|
FEATURE_COLUMN_BOARD_COLLABORA_ENABLED=true
|
|
FEATURE_COLUMN_BOARD_ENABLED=true
|
|
FEATURE_COLUMN_BOARD_EXTERNAL_TOOLS_ENABLED=true
|
|
FEATURE_COLUMN_BOARD_FILE_FOLDER_ENABLED=true
|
|
FEATURE_COLUMN_BOARD_H5P_ENABLED=true
|
|
FEATURE_COLUMN_BOARD_LINK_ELEMENT_ENABLED=true
|
|
FEATURE_COLUMN_BOARD_SHARE=true
|
|
FEATURE_COLUMN_BOARD_SOCKET_ENABLED=true
|
|
# local override (live: true) — needs infrastructure we do not run
|
|
FEATURE_COLUMN_BOARD_VIDEOCONFERENCE_ENABLED=false
|
|
FEATURE_COMMON_CARTRIDGE_COURSE_EXPORT_ENABLED=false
|
|
FEATURE_COMMON_CARTRIDGE_COURSE_IMPORT_ENABLED=false
|
|
FEATURE_COMMON_CARTRIDGE_COURSE_IMPORT_MAX_FILE_SIZE=1073741824
|
|
# local override (live: true) — otherwise every seeded user hits a consent wall
|
|
FEATURE_CONSENT_NECESSARY=false
|
|
FEATURE_COPY_SERVICE_ENABLED=true
|
|
FEATURE_COURSE_SHARE=true
|
|
FEATURE_CTL_TOOLS_COPY_ENABLED=true
|
|
FEATURE_ENABLE_LDAP_SYNC_DURING_MIGRATION=false
|
|
FEATURE_EXTERNAL_PERSON_REGISTRATION_ENABLED=false
|
|
FEATURE_EXTERNAL_SYSTEM_LOGOUT_ENABLED=false
|
|
FEATURE_FWU_CONTENT_ENABLED=false
|
|
FEATURE_LESSON_SHARE=true
|
|
FEATURE_LOGIN_LINK_ENABLED=false
|
|
FEATURE_MEDIA_SHELF_ENABLED=true
|
|
FEATURE_NOTIFICATIONS_ENABLED=false
|
|
FEATURE_PREFERRED_CTL_TOOLS_ENABLED=true
|
|
FEATURE_ROOM_ADD_EXTERNAL_PERSONS_ENABLED=false
|
|
FEATURE_ROOM_COPY_ENABLED=true
|
|
FEATURE_ROOM_LINK_INVITATION_EXTERNAL_PERSONS_ENABLED=false
|
|
FEATURE_ROOM_REGISTER_EXTERNAL_PERSONS_ENABLED=false
|
|
FEATURE_ROOM_SHARE=true
|
|
FEATURE_SCHOOL_POLICY_ENABLED_NEW=true
|
|
FEATURE_SCHOOL_TERMS_OF_USE_ENABLED=true
|
|
FEATURE_SCHULCONNEX_COURSE_SYNC_ENABLED=false
|
|
FEATURE_SCHULCONNEX_MEDIA_LICENSE_ENABLED=false
|
|
FEATURE_SHOW_MIGRATION_WIZARD=false
|
|
FEATURE_SHOW_OUTDATED_USERS=false
|
|
FEATURE_TASK_SHARE=true
|
|
FEATURE_TEAMS_ENABLED=true
|
|
FEATURE_TEAM_CREATE_ROOM_ENABLED=true
|
|
FEATURE_TLDRAW_ENABLED=true
|
|
FEATURE_USER_LOGIN_MIGRATION_ENABLED=false
|
|
FEATURE_USER_MIGRATION_ENABLED=false
|
|
# local override (live: true) — needs infrastructure we do not run
|
|
FEATURE_VIDEOCONFERENCE_ENABLED=false
|
|
FEATURE_VIDIS_MEDIA_ACTIVATIONS_ENABLED=false
|
|
|
|
# --- required-but-unused endpoints ---------------------------------------
|
|
# The config classes validate these as present strings even when the feature
|
|
# is off, so they get a placeholder rather than a real service. Hydra is the
|
|
# OAuth2 provider behind external tool launches; we do not run it.
|
|
HYDRA_URI=http://hydra.invalid:4444
|