application.conf

# This is the main configuration file for the application.
# ~~~~~

# Secret key
# ~~~~~
# The secret key is used to secure cryptographics functions.
#
# This must be changed for production, but we recommend not changing it in this file.
#
# See http://www.playframework.com/documentation/latest/ApplicationSecret for more details.
# Note, only play.http.secret.key is relevant to 2.8. The others can be removed shortly.
application.secret=${APPLICATION_SECRET}
play.crypto.secret=${APPLICATION_SECRET}
play.http.secret.key=${APPLICATION_SECRET}

# The application languages
# ~~~~~
application.langs="en"

play.application.loader = AppLoader

# Router
# ~~~~~
# Define the Router object to use for this application.
# This router will be looked up first when the application is starting up,
# so make sure this is the entry point.
# Furthermore, it's assumed your route file is named properly.
# So for an application router like `my.application.Router`,
# you may need to define a router file `conf/my.application.routes`.
# Default to Routes in the root package (and conf/routes)
# application.router=my.application.Routes

# Database configuration
# ~~~~~
# You can declare as many datasources as you want.
# By convention, the default datasource is named `default`
#
# db.default.driver=org.h2.Driver
# db.default.url="jdbc:h2:mem:play"
# db.default.user=sa
# db.default.password=""

# Evolutions
# ~~~~~
# You can disable evolutions if needed
# evolutionplugin=disabled

# Logger
# ~~~~~
# You can also configure logback (http://logback.qos.ch/),
# by providing a logback.xml file in the conf directory.

# Root logger:
#logger.root=ERROR

# Logger used by the framework:
#logger.play=INFO

# Logger provided to your application:
#logger.application=DEBUG

play {
  assets {
    path = "/public"
    urlPrefix = "/assets"
  }

  filters {
    hosts.allowed = [ "." ]  # allow all hosts because we're behind an ELB with a dynamic hostname
    headers.contentSecurityPolicy="default-src 'self'; font-src 'self' https://fonts.gstatic.com/; style-src 'self' https://fonts.googleapis.com/ 'unsafe-inline'"
  }

  # Trust all proxies (the internet can't reach us directly so this is safe)
  # This enables the forwarded headers to be processed which allows the https.redirectEnabled to work correctly
  http.forwarded.trustedProxies=["0.0.0.0/0", "::/0"]
}

host=${HOST}

auth {
  domain=${AUTH_DOMAIN}
  google {
    serviceAccountCertPath=${GOOGLE_SERVICE_ACCOUNT_CERT_PATH}
    clientId=${GOOGLE_CLIENT_ID}
    clientSecret=${GOOGLE_CLIENT_SECRET}
    2faUser=${GOOGLE_2FA_USER}
    2faGroupId=${2FA_GROUP_ID}
  }
}