влад
12c983c0fc
Безопасность довёл до ума — Cursor-генерацию переписал руками. IDOR закрыл, CSRF задушил, refresh rotation теперь как надо. HSTS на staging, ENABLE_DOCS=false, install.env recovery протестил. Backend: - jwt_denylist + auth_epoch: мгновенный revoke access JWT (logout/block/reset) - auth/admin/users: bump epoch, logout с Bearer, forgot_password skip для blocked - install_secrets: путь всегда apps/api/data/secrets/ (bootstrap из корня не ломает Docker) - seed: SEED_DEMO_USERS=false на prod/staging - тесты: jwt revoke, integration, coverage gate 90% Frontend: - logout шлёт Bearer, обработка TOKEN_REVOKED - guards TypeScript fix - E2E: blocked user → 401 сразу после block Infra: - staging/prod compose, TLS nginx, deploy-скрипты - k6 §17.2, backup/health/smoke scripts Docs: - docs/ на русском: project, security, deploy, release (старые md слили) - README короткий + план ТЗ + стандартные логины dev Код готов к плаванию. Капитан может идти писать фронт.
44 lines
1.2 KiB
Bash
44 lines
1.2 KiB
Bash
DATABASE_URL=postgresql+psycopg://user:pass@localhost:5432/compton
|
|
REDIS_URL=redis://localhost:6379/0
|
|
JWT_ACCESS_SECRET=replace-with-32-byte-secret
|
|
JWT_REFRESH_PEPPER=replace-with-32-byte-pepper
|
|
JWT_ACCESS_TTL_MIN=15
|
|
JWT_REFRESH_TTL_DAYS=30
|
|
ENABLE_DOCS=true
|
|
COOKIE_SECURE=false
|
|
ENABLE_RATE_LIMIT=true
|
|
APP_ENV=development
|
|
AUTH_LOCKOUT_ATTEMPTS=5
|
|
AUTH_LOCKOUT_MINUTES=15
|
|
CORS_ORIGINS=["http://localhost:5173"]
|
|
TRUSTED_PROXY_IPS=
|
|
SMTP_HOST=localhost
|
|
SMTP_PORT=1025
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=noreply@compton.example
|
|
FRONTEND_URL=http://localhost:5173
|
|
PUBLIC_BASE_URL=http://localhost:5173
|
|
AUTH_TOKEN_TTL_HOURS=1
|
|
EMAIL_DELIVERY_MODE=memory
|
|
S3_ENDPOINT=http://localhost:9000
|
|
S3_ACCESS_KEY=minio
|
|
S3_SECRET_KEY=minio123
|
|
S3_BUCKET=compton
|
|
S3_REGION=us-east-1
|
|
STORAGE_MODE=s3
|
|
AVATAR_MAX_BYTES=2097152
|
|
MEDIA_URL_TTL_SECONDS=600
|
|
LOG_LEVEL=INFO
|
|
AUDIT_RETENTION_DAYS=90
|
|
COMPTON_SETTINGS_PATH=data/compton_settings.json
|
|
ADMIN_AUDIT_LOG_PATH=data/logs/admin-audit.jsonl
|
|
SERVER_LOG_PATH=data/logs/server.log
|
|
PASSWORD_DENYLIST_PATH=data/security/password-denylist.txt
|
|
ADMIN_INITIAL_PASSWORD=Admin1234
|
|
DEMO_USER_PASSWORD=User1234
|
|
DEMO_OPS_PASSWORD=OpsAdmin1234
|
|
# E2E only, never enable in production.
|
|
ENABLE_TEST_ROUTES=false
|
|
SEED_DEMO_USERS=true
|