intranet-page settings | RigFabTech docs

What intranet-page needs from you before it installs. It goes in one small file, intranet-page.yaml, which you pass to helm install and helm upgrade after site.yaml, as Install shows.

Starter file

intranet-page.yaml holds every setting on this page with its description. Save it, replace each <PLACEHOLDER> and remove the optional lines you don't need. intranet-page.schema.json describes the file to editors that check YAML against a JSON schema.

Settings

Plain values, under settings in intranet-page.yaml.

Setting	Required	Default	Description
`settings.aiUrl`	No	`""`	The AI assistant's address, such as https://ai.example.com, which the home page's Ask AI search opens; leave it empty to hide the search

Secret settings

Passwords, keys and other values to keep private.

Name	Required	Description
`AZURE_AD_CLIENT_ID`	Yes	The application (client) ID of the app registration people sign in to intranet-page with at Microsoft Entra ID
`AZURE_AD_CLIENT_SECRET`	Yes	The client secret of the app registration people sign in to intranet-page with at Microsoft Entra ID
`AZURE_AD_TENANT_ID`	Yes	Your Microsoft Entra tenant's ID
`ENTRA_MANAGEMENT_GROUP_ID`	Yes	The object ID of the Microsoft Entra group whose members moderate shout-outs and post alert banners; the app registration must send group membership in its tokens (the groups claim)
`EMPLOYEES_API_KEY`	Yes	The shared key employees-api accepts, which the staff directory and birthdays are read with; give the same value as employees-api's EMPLOYEES_API_KEY
`OPENWEATHER_API_KEY`	Yes	The API key of your OpenWeather account, from openweathermap.org, which the weather card is loaded with
`LMS_API_SCOPE`	No	The scope the learning management system's app registration exposes, such as api://00000000-0000-0000-0000-000000000000/access_as_user, which the training card reads each person's assigned training with; without it the card cannot load

Give them in one of two ways, never both.

In production, in a Secret of your own. A values file with passwords in it tends to end up in git, and Helm keeps a copy of the values you pass in its release record in the cluster. Write the values to a file, intranet-page.env, one NAME=value per line with each value as it is, without quotes, then create the Secret and delete the file:

kubectl create secret generic intranet-page-settings --namespace rft-app-intranet-page --from-env-file=intranet-page.env
rm intranet-page.env

In intranet-page.yaml, give only the Secret's name:

secrets:
  existingSecret: intranet-page-settings

To keep the Secret in git or a secret store instead, create it with External Secrets Operator, SOPS or Sealed Secrets, with the same keys.

The Secret needs a key for every required name above. When one is missing, the product's pods don't start: kubectl --namespace rft-app-intranet-page get pods shows CreateContainerConfigError or Init:CreateContainerConfigError, and kubectl --namespace rft-app-intranet-page describe pods names the missing key. Add it and the pods start by themselves. After you change a value in the Secret, restart the product with kubectl --namespace rft-app-intranet-page rollout restart deployment.

To get started, in the values file. Under secrets in intranet-page.yaml, as the starter file has them. The chart keeps them in the Secret intranet-page-env.

Made for you

The platform makes these once and keeps them in the Secret intranet-page-generated. There is nothing to set.

NEXTAUTH_SECRET

In site.yaml

intranet-page answers on intranet-page.<domain>, under your global.rigfab.domain. To give it another name, set global.rigfab.hosts.intranet-page to the full host name.

Check before you install

Once the base chart is installed, and before you install or upgrade this product:

rft check --chart oci://registry.rigfab.com/rft/apps/intranet-page/charts/intranet-page --version <VERSION> --release intranet-page --namespace rft-app-intranet-page --values site.yaml --values intranet-page.yaml

It renders the chart with your files and asks the cluster whether it would accept the result, and changes nothing. A setting that is missing or misspelt in your files stops it with a message that names the setting. It doesn't look inside a Secret of your own. A misspelt name under global.rigfab is the base chart's to refuse, so check site.yaml with the base chart after every change to it, as Install shows.