LinuxBrokerForAVDAccess/api/env.example at main · microsoft/LinuxBrokerForAVDAccess · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Deployment Configuration
SCM_DO_BUILD_DURING_DEPLOYMENT="true"

# Application Insights Configuration
APPLICATIONINSIGHTS_CONNECTION_STRING="InstrumentationKey=your_instrumentation_key;IngestionEndpoint=https://your_ingestion_endpoint;LiveEndpoint=https://your_live_endpoint;ApplicationId=your_application_id"
ApplicationInsightsAgent_EXTENSION_VERSION="~3"
APPLICATIONINSIGHTSAGENT_EXTENSION_ENABLED="true"
WEBSITE_HTTPLOGGING_RETENTION_DAYS="7"

# Azure VM Configuration
VM_SUBSCRIPTION_ID="your_subscription_id"
VM_RESOURCE_GROUP="your_resource_group"
AVD_HOST_GROUP_ID="your_avd_host_group_id"
LINUX_HOST_GROUP_ID="your_linux_host_group_id"
LINUX_HOST_ADMIN_LOGIN_NAME="your_linux_host_admin_login_name"

# Database Configuration
DB_SERVER="your_database_server"
DB_DATABASE="your_database_name"
DB_USERNAME="your_database_username"

# Azure AD Authentication
CLIENT_ID="your_client_id"
TENANT_ID="your_tenant_id"

# Target Azure cloud: AzurePublic, AzureUSGovernment, or AzureCustom.
# AzurePublic and AzureUSGovernment resolve the endpoints below automatically.
# AzureCustom requires all three to be set explicitly.
AZURE_CLOUD_NAME="AzurePublic"
# AZURE_AUTHORITY_HOST="https://login.microsoftonline.com"
# GRAPH_ENDPOINT="https://graph.microsoft.com"
# STS_ISSUER_HOST="https://sts.windows.net"

# Microsoft Graph API
GRAPH_API_ENDPOINT="https://graph.microsoft.com/.default"

# Authentication Secret for Microsoft Provider
MICROSOFT_PROVIDER_AUTHENTICATION_SECRET="your_authentication_secret"

# Domain and Vault Configuration
DOMAIN_NAME="your_domain_name"

# Secrets Managed in Azure Vault
VAULT_URL="https://your_vault_name.vault.azure.net/"
KEY_NAME="your_key_name"
DB_PASSWORD_NAME="db_password_key_in_vault"

# Optional vault for the keys that unlock each user's login keyring (secrets keyring-<uid>).
# The API needs Key Vault Secrets Officer on it. Leave unset to send no keys.
# KEYRING_VAULT_URL="https://your_keyring_vault_name.vault.azure.net/"

# NFS export mounted on the Linux hosts for user home directories. Passed to
# create-user.sh during checkout; leave empty if the hosts use local home directories.
NFS_SHARE="your_nfs_server:/export/home"

# Portal users need the Reader, Operator or FullAccess app role. Set to true only while
# roles are assigned during an upgrade: it treats the access_as_user scope as FullAccess.
ALLOW_LEGACY_SCOPE_ACCESS="false"

# Optional tuning; see api/README.md for the defaults.
# DB_MAX_CONCURRENCY="6"
# DB_POOL_ENABLED="true"
# DB_POOL_IDLE_SECONDS="120"
# DB_POOL_MAX_LIFETIME_SECONDS="1800"
# GUNICORN_CMD_ARGS="--workers 2 --threads 8 --timeout 120"

# Audit entries older than this many days are purged daily by the scheduled task
# (30 to 3650, default 365). Application Insights keeps its own copy of each entry.
# AUDIT_RETENTION_DAYS="365"

# The host agent version fleet health expects. Defaults to the version in api/config.py;
# override only to quiet the "agent outdated" flag during a staged host migration.
# EXPECTED_HOST_AGENT_VERSION="1.0.0"
# Checkout and host-start events older than this many days are purged with the audit log
# (7 to 3650, default 90). They feed the dashboard's capacity and checkout charts.
# CHECKOUT_EVENT_RETENTION_DAYS="90"
# Broadcast messages: hosts messaged at once, the SSH timeout per host, and the time after
# which no new host is tried.
# BROADCAST_CONCURRENCY="10"
# BROADCAST_HOST_TIMEOUT_SECONDS="20"
# BROADCAST_DEADLINE_SECONDS="60"
# Rolling maintenance: how long one scheduled advance may work (15 to 100 seconds, default
# 45), and how long a host's patch may run before it is retried (10 to 600 minutes, default 90).
# MAINTENANCE_ADVANCE_DEADLINE_SECONDS="45"
# MAINTENANCE_PATCH_TIMEOUT_MINUTES="90"