nessi
f925009977
Add complete NexaMFA push MFA system with: - FastAPI backend with PostgreSQL, Redis, OIDC provider, and Prometheus metrics - React TypeScript admin console - Android Kotlin/Jetpack Compose app with biometric authentication - Docker Compose deployment configuration - Gitea CI workflow for backend, frontend, and Android builds - Environment configuration template with security settings - Documentation for security model, deployment
50 lines
1.7 KiB
Python
50 lines
1.7 KiB
Python
from functools import lru_cache
|
|
from typing import Literal
|
|
|
|
from pydantic import AnyHttpUrl, Field, computed_field
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
|
|
|
|
app_name: str = "NexaMFA"
|
|
environment: Literal["dev", "test", "prod"] = "dev"
|
|
public_base_url: AnyHttpUrl = "https://mfa.example.com"
|
|
cors_origins: str = "http://localhost:5173"
|
|
|
|
database_url: str = "postgresql+asyncpg://nexamfa:nexamfa@postgres:5432/nexamfa"
|
|
redis_url: str = "redis://redis:6379/0"
|
|
|
|
admin_token: str = Field(default="change-me-admin-token")
|
|
oidc_issuer: str = "https://mfa.example.com"
|
|
oidc_client_id: str = "authentik"
|
|
oidc_client_secret: str = "change-me-oidc-secret"
|
|
oidc_redirect_uris: str = "https://authentik.example.com/application/o/nexamfa/callback/"
|
|
oidc_signing_key_pem: str | None = None
|
|
|
|
challenge_ttl_seconds: int = 60
|
|
enrollment_ttl_seconds: int = 600
|
|
access_token_ttl_seconds: int = 300
|
|
auth_code_ttl_seconds: int = 120
|
|
rate_limit_default: str = "120/minute"
|
|
rate_limit_approve: str = "12/minute"
|
|
|
|
fcm_project_id: str | None = None
|
|
fcm_service_account_json: str | None = None
|
|
|
|
@computed_field
|
|
@property
|
|
def cors_origin_list(self) -> list[str]:
|
|
return [origin.strip() for origin in self.cors_origins.split(",") if origin.strip()]
|
|
|
|
@computed_field
|
|
@property
|
|
def oidc_redirect_uri_list(self) -> list[str]:
|
|
return [uri.strip() for uri in self.oidc_redirect_uris.split(",") if uri.strip()]
|
|
|
|
|
|
@lru_cache
|
|
def get_settings() -> Settings:
|
|
return Settings()
|