nessi
dfec7976c4
Add ALLOWED_HOSTS configuration to restrict trusted hosts in TrustedHostMiddleware. Enhance SSRF protection to block all private, loopback, link-local, multicast, reserved, and unspecified IP addresses using ipaddress module and DNS resolution checks. Add encrypt_value/decrypt_value aliases for encryption functions. Upgrade PostgreSQL from 16 to 18.4 in Docker Compose with updated data directory path (/var/lib/postgresql). Add security_opt no
80 lines
2.6 KiB
Bash
80 lines
2.6 KiB
Bash
# ============================================================
|
|
# NexaDash Environment Configuration
|
|
# ============================================================
|
|
|
|
# -----------------------------------------------------------
|
|
# General
|
|
# -----------------------------------------------------------
|
|
NODE_ENV=production
|
|
NEXADASH_API_URL=http://localhost:8000
|
|
NEXADASH_WEB_URL=http://localhost:3000
|
|
NEXADASH_SECRET_KEY=change-this-to-a-random-32-byte-secret-key!!!!
|
|
NEXADASH_ENCRYPTION_KEY=change-this-to-a-random-32-byte-fernet-key!!
|
|
|
|
# -----------------------------------------------------------
|
|
# Database
|
|
# -----------------------------------------------------------
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_USER=nexadash
|
|
POSTGRES_PASSWORD=change-this-strong-password
|
|
POSTGRES_DB=nexadash
|
|
DATABASE_URL=postgresql+asyncpg://nexadash:change-this-strong-password@postgres:5432/nexadash
|
|
|
|
# -----------------------------------------------------------
|
|
# Redis
|
|
# -----------------------------------------------------------
|
|
REDIS_HOST=redis
|
|
REDIS_PORT=6379
|
|
REDIS_PASSWORD=change-this-redis-password
|
|
REDIS_URL=redis://:change-this-redis-password@redis:6379/0
|
|
CELERY_BROKER_URL=redis://:change-this-redis-password@redis:6379/1
|
|
CELERY_RESULT_BACKEND=redis://:change-this-redis-password@redis:6379/2
|
|
|
|
# -----------------------------------------------------------
|
|
# Security
|
|
# -----------------------------------------------------------
|
|
ACCESS_TOKEN_EXPIRE_MINUTES=15
|
|
REFRESH_TOKEN_EXPIRE_DAYS=7
|
|
ARGON2_TIME_COST=2
|
|
ARGON2_MEMORY_COST=65536
|
|
ARGON2_PARALLELISM=1
|
|
MAX_LOGIN_ATTEMPTS=5
|
|
LOGIN_LOCKOUT_MINUTES=15
|
|
RATE_LIMIT_DEFAULT=100
|
|
RATE_LIMIT_LOGIN=10
|
|
ALLOWED_HOSTS=localhost,127.0.0.1,testserver,nexadash-api
|
|
|
|
# -----------------------------------------------------------
|
|
# Mail (SMTP)
|
|
# -----------------------------------------------------------
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_TLS=true
|
|
SMTP_STARTTLS=true
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=nexadash@localhost
|
|
|
|
# -----------------------------------------------------------
|
|
# Worker
|
|
# -----------------------------------------------------------
|
|
WORKER_CONCURRENCY=4
|
|
|
|
# -----------------------------------------------------------
|
|
# Plugins / Sandboxing
|
|
# -----------------------------------------------------------
|
|
PLUGIN_DIR=/app/plugins
|
|
PLUGIN_SANDBOX_ENABLED=true
|
|
|
|
# -----------------------------------------------------------
|
|
# Optional: Sentry / Monitoring
|
|
# -----------------------------------------------------------
|
|
SENTRY_DSN=
|
|
|
|
# -----------------------------------------------------------
|
|
# Ports used by docker-compose
|
|
# -----------------------------------------------------------
|
|
API_PORT=8000
|
|
WEB_PORT=3000
|