mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-25 20:47:18 +09:00
Juan DenisandClaude Fable 5
dcdd60b609
Five env_bool-parsed flags had no line in either .env.example. The two ALLOW_* switches are security-relevant opt-ins (pip runs with backend privileges; private download URLs) and must be discoverable; the demo and staging flags are documented alongside them so the gap stops being unnamed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
69 lines
3.1 KiB
Bash
69 lines
3.1 KiB
Bash
# Flask Configuration
|
|
FLASK_ENV=development
|
|
|
|
# IMPORTANT: Generate secure keys for production!
|
|
# Run: python -c "import secrets; print(secrets.token_hex(32))"
|
|
SECRET_KEY=change-this-to-a-secure-random-string
|
|
|
|
# Database
|
|
DATABASE_URL=sqlite:///serverkit.db
|
|
|
|
# JWT Configuration
|
|
# IMPORTANT: Generate a unique key for production!
|
|
# Run: python -c "import secrets; print(secrets.token_hex(32))"
|
|
JWT_SECRET_KEY=change-this-to-another-secure-random-string
|
|
|
|
# CORS - comma-separated list of allowed origins
|
|
CORS_ORIGINS=http://localhost:41921,http://127.0.0.1:41921,http://localhost:47927,http://127.0.0.1:47927
|
|
|
|
# Server
|
|
PORT=47927
|
|
|
|
# Trusted reverse proxy (client IP)
|
|
# Default OFF for local dev: run.py is directly exposed with no proxy, so an
|
|
# X-Forwarded-For header would be client-forgeable and must NOT be trusted.
|
|
# In production the panel sits behind its bundled nginx — set this to true there
|
|
# (the shipped .env.example does) so ServerKit derives the real client IP via
|
|
# ProxyFix for rate-limiting / login lockout / audit logs. TRUSTED_PROXY_HOPS is
|
|
# the number of proxies in front of Flask (bundled nginx = 1).
|
|
# TRUST_PROXY_HEADERS=false
|
|
# TRUSTED_PROXY_HOPS=1
|
|
|
|
# Login brute-force throttle (per client IP), on top of per-user lockout.
|
|
# Defaults shown; uncomment to tune.
|
|
# AUTH_IP_MAX_ATTEMPTS=10
|
|
# AUTH_IP_WINDOW_MINUTES=15
|
|
# AUTH_IP_BLOCK_MINUTES=15
|
|
|
|
# Security - Agent API Secret Encryption
|
|
# IMPORTANT: Generate a unique key for production!
|
|
# Run: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
# Or: python -c "import base64; import os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())"
|
|
SERVERKIT_ENCRYPTION_KEY= # Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
|
|
# GitHub Repository for agent releases (owner/repo format)
|
|
# This is used to fetch the latest agent version for the downloads page
|
|
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit
|
|
|
|
# Dev path overrides (uncomment for local development)
|
|
# Production defaults are absolute Linux paths (/var/serverkit, /etc/serverkit, etc.)
|
|
# SERVERKIT_DIR=./dev-data
|
|
# SERVERKIT_CONFIG_DIR=./dev-data/config
|
|
# SERVERKIT_LOG_DIR=./dev-data/logs
|
|
# SERVERKIT_BACKUP_DIR=./dev-data/backups
|
|
# SERVERKIT_CACHE_DIR=./dev-data/cache
|
|
# SERVERKIT_QUARANTINE_DIR=./dev-data/quarantine
|
|
|
|
# Public URL agents should dial back to. Set this whenever the panel sits
|
|
# behind a reverse proxy / tunnel / custom domain — the connection string
|
|
# the panel issues to agents will embed this URL instead of the request's
|
|
# Host header (which would otherwise be the internal IP/port).
|
|
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com
|
|
|
|
# Security opt-ins & special modes (all default off)
|
|
# SERVERKIT_ALLOW_PLUGIN_PIP=false # let extensions pip-install their requirements
|
|
# SERVERKIT_ALLOW_PRIVATE_DOWNLOADS=false # allow non-HTTPS/private extension downloads
|
|
# SERVERKIT_DEMO_MODE=false # read-only demo panel
|
|
# SERVERKIT_DEMO_DEPLOYS=false # simulated deploys through the real pipeline
|
|
# SERVERKIT_STAGING=false # mark this panel as staging (/health flag)
|