riyadhafraa
fa31fb6374
Pushed the existing main-branch commits (sincee0a4652) to the Gitea origin remote as a new branch `replit-sync-deployment-hardening` so the user can open a PR manually. No code edits in this task — all changes were already committed on `main` by task #538. Branch contents (3 commits sincee0a4652): -f16f476Improve handling of external proxy configurations and session security -7d13e8edeployment: harden self-hosted install behind HTTPS reverse proxies -a01e102Update documentation to clarify CORS error impact on user login Files changed (5): artifacts/api-server/src/app.ts, scripts/src/seed.ts, .env.example, .env.docker.example (covered inf16f476), docker-compose.yml, README.md. Push details: - Authenticated via GITEA_TOKEN (oauth2 user) embedded in the push URL. - Token filtered out of all logged output via sed. - No `--force` used. Gitea accepted the push as a brand-new branch. - Gitea echoed the PR-create URL: /rafraa/TX/pulls/new/replit-sync-deployment-hardening Deviations from the plan: - Plan step 1-2 said to "create branch frome0a4652+ commit fresh". Sandbox blocks `git switch -c` / `git commit` even in this task agent, so I pushed HEAD as the new branch instead. The result on Gitea is identical — the diff vs `main` is the same 5 files; only the commit history granularity differs (3 small commits vs 1 squashed commit). If the user prefers a single squashed commit they can squash-merge the PR on Gitea. - The `test` workflow is failing on the api-server start race, but that's out of scope for #539 and is already covered by task #540 (Auto-start the API server when running tests).
140 lines
6.6 KiB
Bash
140 lines
6.6 KiB
Bash
# ============================================================================
|
|
# Tx OS — environment configuration. Copy to `.env` and edit before deploying.
|
|
# Everything in this file is read either by docker-compose.yml at `up` time
|
|
# or directly by the application processes (`api-server`, `tx-os`, scripts).
|
|
# NEVER commit `.env` — it is gitignored. `.env.example` is the public template.
|
|
# ============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Host ports (compose only)
|
|
# -----------------------------------------------------------------------------
|
|
# Port the SPA (nginx) is reachable on. Front with TLS in production.
|
|
WEB_PORT=3000
|
|
# Port the API container is reachable on. In public deployments, bind this
|
|
# to 127.0.0.1 only so the edge proxy is the sole external entry point.
|
|
API_PORT=8080
|
|
# Component preview server port (dev profile only).
|
|
MOCKUP_PORT=8081
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# API server runtime
|
|
# -----------------------------------------------------------------------------
|
|
# In compose this is set automatically; required when running natively.
|
|
PORT=8080
|
|
# Public base URL the SPA + API are reachable at. Used to build absolute
|
|
# upload URLs for the local-FS storage driver and to validate CORS origins.
|
|
PUBLIC_BASE_URL=http://localhost:3000
|
|
# Comma-separated list of origins allowed by the API server's CORS layer.
|
|
# Must include PUBLIC_BASE_URL and any additional reverse-proxy domains.
|
|
ALLOWED_ORIGINS=http://localhost:3000
|
|
# pino log level: trace | debug | info | warn | error | fatal
|
|
LOG_LEVEL=info
|
|
# 32+ random bytes. Generate with `openssl rand -hex 32`. REQUIRED.
|
|
SESSION_SECRET=change-me-session-secret-min-32-chars-please
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Local hostname / TLS (used by Caddy + the Setup Wizard)
|
|
# -----------------------------------------------------------------------------
|
|
# Hostname operators reach the system at on the LAN. The Caddy edge
|
|
# binds this name and serves the mkcert-issued certificate.
|
|
LOCAL_DOMAIN=tx.local
|
|
# Auto-detected by scripts/local-setup.sh — the host's LAN IP. Used as
|
|
# an additional SAN on the local certificate so phones / tablets that
|
|
# can't resolve mDNS can still reach the system at https://<ip>/.
|
|
LOCAL_IP=
|
|
# Canonical public URL the SPA + API are reachable at. Setup Wizard
|
|
# stores this in system_settings.base_url at install time.
|
|
BASE_URL=https://tx.local
|
|
# Edge ports (Caddy). Set HTTP_PORT=8080 / HTTPS_PORT=8443 if you
|
|
# can't bind privileged ports.
|
|
HTTP_PORT=80
|
|
HTTPS_PORT=443
|
|
# TLS strategy:
|
|
# local — local-setup.sh provisions ./certs/local-{cert,key}.pem via mkcert
|
|
# byo — operator drops their own cert/key into ./certs/ with the same names
|
|
# skip — DEVELOPER ONLY: serve plaintext on :80, no HTTPS. Never use
|
|
# outside trusted local development networks.
|
|
HTTPS_MODE=local
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# SPA build (tx-os) — read by Vite at build time AND `pnpm --filter tx-os dev`
|
|
# -----------------------------------------------------------------------------
|
|
# Path the SPA is mounted at. Use "/" when serving from the domain root.
|
|
BASE_PATH=/
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Database
|
|
# -----------------------------------------------------------------------------
|
|
POSTGRES_USER=tx
|
|
POSTGRES_PASSWORD=change-me-postgres
|
|
POSTGRES_DB=tx_os
|
|
# Composed automatically by docker-compose; set explicitly when running natively.
|
|
# DATABASE_URL=postgres://tx:change-me-postgres@localhost:5432/tx_os
|
|
DATABASE_URL=postgres://tx:change-me-postgres@db:5432/tx_os
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Object storage
|
|
# -----------------------------------------------------------------------------
|
|
# Driver selection. Set to "s3" for production (MinIO/S3); "local" persists
|
|
# uploads on the API container's filesystem (single-host, dev-only).
|
|
# If unset, the driver auto-detects: "s3" when S3_ENDPOINT is set, else "local".
|
|
STORAGE_DRIVER=s3
|
|
|
|
# Bucket-level paths used by the API. Format: /<bucket>/<prefix>
|
|
PRIVATE_OBJECT_DIR=/tx-private/private
|
|
PUBLIC_OBJECT_SEARCH_PATHS=/tx-public/public
|
|
|
|
# Bucket names — created on first boot by the minio-init container.
|
|
S3_BUCKET_PRIVATE=tx-private
|
|
S3_BUCKET_PUBLIC=tx-public
|
|
|
|
# S3-compatible endpoint URL. For MinIO running in compose this is the
|
|
# in-network DNS name. For AWS S3 leave blank (the SDK uses the default
|
|
# regional endpoint). For Cloudflare R2 / Backblaze B2, set the vendor URL.
|
|
S3_ENDPOINT=http://minio:9000
|
|
|
|
# MinIO root credentials. Used both as MINIO_ROOT_USER/PASSWORD and as the
|
|
# API server's S3 access key. Change before first boot.
|
|
S3_ACCESS_KEY_ID=tx-minio-admin
|
|
S3_SECRET_ACCESS_KEY=change-me-minio-secret-min-20-chars
|
|
|
|
# Region label is cosmetic for MinIO but @aws-sdk requires one.
|
|
S3_REGION=us-east-1
|
|
|
|
# Path-style addressing is required by MinIO and most non-AWS S3 backends.
|
|
# Set to "false" only when targeting real AWS S3 (which prefers virtual-host
|
|
# style). Defaults to "true" inside the API server.
|
|
S3_FORCE_PATH_STYLE=true
|
|
|
|
# Local-FS driver settings (only consulted when STORAGE_DRIVER=local).
|
|
# Filesystem root for uploaded objects. Defaults to ./storage relative to
|
|
# the API server's working directory.
|
|
LOCAL_STORAGE_ROOT=./storage
|
|
# HMAC key used to sign + verify upload URLs for the local driver. If
|
|
# unset, the driver falls back to SESSION_SECRET. Set explicitly to rotate
|
|
# upload-URL trust independently of session trust.
|
|
LOCAL_STORAGE_SIGNING_SECRET=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Seeded demo accounts (OPTIONAL since the Setup Wizard exists)
|
|
# -----------------------------------------------------------------------------
|
|
# When BOTH variables are set, the migrate container creates an `admin`
|
|
# and `ahmed` user with these passwords on first boot and immediately
|
|
# marks the install complete (skipping the wizard). When EITHER is unset,
|
|
# the seed creates only roles/permissions and leaves admin creation to
|
|
# the first-run wizard at /setup.
|
|
SEED_ADMIN_PASSWORD=
|
|
SEED_USER_PASSWORD=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Email (optional)
|
|
# -----------------------------------------------------------------------------
|
|
# Leave SMTP_HOST blank to disable outbound mail. The Executive Meetings
|
|
# notifier no-ops when no SMTP config is present.
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_SECURE=false
|
|
SMTP_FROM=Tx OS <noreply@example.com>
|