clientst0r/.env.example at main · agit8or1/clientst0r · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
# Client St0r — environment configuration template
#
# Copy this file to `.env` (same directory) and fill in real values:
#   cp .env.example .env
#
# `.env` is gitignored — never commit it. Every secret in this file
# is a placeholder; do not ship these defaults to production.

# ─── Core ─────────────────────────────────────────────────────────────

# Generate with: python -c "import secrets; print(secrets.token_urlsafe(64))"
SECRET_KEY=replace-me-with-a-long-random-string

# Set to False in production. Leave True ONLY for local dev.
DEBUG=False

# Comma-separated list of host headers Django will accept. Wildcards
# are supported (*.example.com). When DEBUG=True, ALL hosts are
# implicitly allowed.
# Examples:
#   ALLOWED_HOSTS=clientst0r.example.com,*.example.com
#   ALLOWED_HOSTS=localhost,127.0.0.1
ALLOWED_HOSTS=localhost,127.0.0.1

# CSRF_TRUSTED_ORIGINS — required for HTTPS POST requests on Django
# 4+. Auto-derived from ALLOWED_HOSTS when blank. Must include the
# scheme (https:// or http://).
# CSRF_TRUSTED_ORIGINS=https://clientst0r.example.com

# Full base URL of the deployed app. Used by email templates, the
# updater, and a few absolute-URL surfaces.
BASE_URL=http://localhost:8000

# ─── Database ─────────────────────────────────────────────────────────

# Engine: `mysql` (MariaDB / MySQL) or `sqlite3`. Default is mysql so
# the docker-compose stack works out of the box.
DB_ENGINE=mysql

# Used by both the `db` container and the `app` container. Pick strong
# values BEFORE the first `docker compose up`.
DB_ROOT_PASSWORD=replace-me-strong-root-password
DB_NAME=clientst0r
DB_USER=clientst0r
DB_PASSWORD=replace-me-strong-app-password

# Inside docker-compose, DB_HOST=db points at the MariaDB service.
# To use an EXTERNAL database, set DB_HOST/DB_PORT to your DB's
# address and `docker compose stop db` after first start.
DB_HOST=db
DB_PORT=3306

# ─── Web port ─────────────────────────────────────────────────────────

# Host port the `app` container publishes 8000 on. Change to avoid
# conflicts with other services on the host.
WEB_PORT=8000

# If you run the optional nginx profile (`docker compose --profile proxy up`):
NGINX_HTTP_PORT=80
NGINX_HTTPS_PORT=443

# ─── Bootstrap superuser (optional) ───────────────────────────────────

# If all three are set, the entrypoint creates this user on first
# boot. Idempotent — won't re-create on subsequent boots.
# Leave blank to skip; you can also create a superuser later with:
#   docker compose exec app python manage.py createsuperuser
DJANGO_SUPERUSER_USERNAME=
DJANGO_SUPERUSER_EMAIL=
DJANGO_SUPERUSER_PASSWORD=

# ─── Email / SMTP ─────────────────────────────────────────────────────

# Used by notification flows (PSA replies, beta signups, etc.).
# Leave blank to disable outbound email — signups still work, you
# just won't receive notifications.
EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend
EMAIL_HOST=
EMAIL_PORT=587
EMAIL_USE_TLS=True
EMAIL_HOST_USER=
EMAIL_HOST_PASSWORD=
DEFAULT_FROM_EMAIL=clientst0r@example.com

# ─── External API tokens (optional) ───────────────────────────────────

# GitHub PAT for the Settings → Updates poll. Anonymous limit is
# 60/hr; with a token it's 5000/hr. Generate at github.com/settings/tokens
# Scope: `public_repo` is enough.
GITHUB_TOKEN=

# Anthropic API key for optional AI-assisted PSA features (psa_ai).
# Leave blank if you don't use AI suggestions.
ANTHROPIC_API_KEY=

# ─── Storage paths ────────────────────────────────────────────────────

# These are the in-container paths. They're backed by docker volumes
# in docker-compose.yml — you usually don't need to change them.
UPLOAD_ROOT=/var/lib/itdocs/uploads
MEDIA_ROOT=/app/media

# ─── Beta-tester signup (operator-side) ──────────────────────────────

# Address that receives notifications when someone fills the public
# /core/beta-test/ form. Leave the default to forward upstream to the
# canonical maintainer.
BETA_ADMIN_EMAIL=agit8or@agit8or.net

# Upstream forwarder. On the canonical install set BETA_UPSTREAM_URL=''
# to disable self-forwarding. On any OTHER install leave this UNSET —
# the default points at the canonical server so signups land there.
# BETA_UPSTREAM_URL=

# ─── Security ─────────────────────────────────────────────────────────

REQUIRE_2FA=True
SESSION_COOKIE_SECURE=True
CSRF_COOKIE_SECURE=True
SECURE_HSTS_SECONDS=31536000
SECURE_SSL_REDIRECT=True

# Axes (brute force protection)
AXES_FAILURE_LIMIT=5
AXES_COOLOFF_TIME=1

# WARNING: enabling private IPs disables SSRF protection. Only set
# True if you need to connect to self-hosted services on your LAN.
# ALLOW_PRIVATE_IP_INTEGRATIONS=False

# ─── Encryption (vault) ───────────────────────────────────────────────

# 32-byte URL-safe base64 key used to encrypt vault secrets at rest.
# CRITICAL: do NOT change this after any vault data has been written —
# all existing ciphertext becomes unreadable. Generate ONCE with:
#   python -c "import secrets, base64; print(base64.urlsafe_b64encode(secrets.token_bytes(32)).decode())"
APP_MASTER_KEY=

# Symmetric HMAC secret for API key signatures.
API_KEY_SECRET=replace-me-with-a-random-string

# ─── Optional Docker image override ───────────────────────────────────

# If set, docker-compose uses this image instead of building locally.
# Useful for production where you pull a pre-built tag.
# CLIENTST0R_IMAGE=ghcr.io/agit8or1/clientst0r:latest