mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-23 03:27:43 +09:00
Juan Denis
d67e5d07d0
Centralize backup schedule calculations and shared request/form flows, encode query values, and move repository finalization into its service. Add browser CI coverage, repair stale test fixtures, and provide opt-in request and build measurement tools.
162 lines
6.6 KiB
Bash
162 lines
6.6 KiB
Bash
# ============================================
|
|
# ServerKit Configuration
|
|
# ============================================
|
|
# Copy this file to .env and customize for your environment
|
|
# Generate secure keys with: python -c "import secrets; print(secrets.token_hex(32))"
|
|
# ============================================
|
|
|
|
# ----------------------------------------
|
|
# REQUIRED: Security Keys
|
|
# ----------------------------------------
|
|
# Generate unique keys for production!
|
|
SECRET_KEY=your-secret-key-here
|
|
JWT_SECRET_KEY=your-jwt-secret-key-here
|
|
# Fernet key for encrypting secrets at rest.
|
|
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
SERVERKIT_ENCRYPTION_KEY=your-fernet-key-here
|
|
|
|
# ----------------------------------------
|
|
# Database Configuration
|
|
# ----------------------------------------
|
|
# SQLite (default - good for small deployments).
|
|
# NOTE the path is relative to the backend working directory.
|
|
# DATABASE_URL=sqlite:///serverkit.db
|
|
|
|
# PostgreSQL (recommended for production):
|
|
# DATABASE_URL=postgresql://user:password@localhost:5432/serverkit
|
|
|
|
# MySQL:
|
|
# DATABASE_URL=mysql://user:password@localhost:3306/serverkit
|
|
|
|
# ── Under Docker, use SERVERKIT_DATABASE_URL instead ──
|
|
# docker-compose.yml pins DATABASE_URL to /app/instance/serverkit.db, the path
|
|
# backed by the persistent volume, and ignores the DATABASE_URL above. That is
|
|
# on purpose: a *relative* sqlite path resolves inside the container and is
|
|
# destroyed by the next `compose down`. To point Docker at another database,
|
|
# set this instead — it wins:
|
|
# SERVERKIT_DATABASE_URL=postgresql://user:password@db:5432/serverkit
|
|
|
|
# ----------------------------------------
|
|
# Network Configuration
|
|
# ----------------------------------------
|
|
# CORS Origins - your domain(s), comma-separated
|
|
CORS_ORIGINS=http://localhost,https://your-domain.com
|
|
|
|
# Public URL that agents should dial back to. Set this whenever the panel
|
|
# sits behind a reverse proxy / tunnel / custom domain — the connection
|
|
# string the panel issues to agents will embed this URL instead of the
|
|
# request's Host header (which would otherwise be the internal IP/port).
|
|
# Leave commented out for plain localhost development.
|
|
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com
|
|
|
|
# Port. Only the Flask *development* server reads this (`python run.py`).
|
|
# Under Docker the container always listens on 5000 and you publish it with
|
|
# SERVERKIT_HTTP_PORT (see docker-compose.yml); under gunicorn the port comes
|
|
# from SERVERKIT_BACKEND_PORT.
|
|
# PORT=5000
|
|
|
|
# ----------------------------------------
|
|
# Trusted reverse proxy (client IP)
|
|
# ----------------------------------------
|
|
# Derive the real client IP from X-Forwarded-For (via Werkzeug ProxyFix) for
|
|
# rate limiting, login lockout and audit logs, instead of logging every request
|
|
# as the proxy's address.
|
|
#
|
|
# Turn it on ONLY when a proxy you control is the sole route in. The header is
|
|
# whatever the caller typed, so if anything can open a connection to the backend
|
|
# port directly, this hands attackers the ability to forge the IP that those
|
|
# very throttles key on.
|
|
#
|
|
# Off by default HERE because this file is the Docker/manual path, and
|
|
# docker-compose.yml publishes port 5000 on all interfaces. Set it to true once
|
|
# you put a proxy in front AND stop direct access to 5000 — bind it to loopback
|
|
# (see docs/INSTALLATION.md → "Running behind your own reverse proxy") or
|
|
# firewall it.
|
|
#
|
|
# Host installs do not use this file: install.sh writes its own .env and enables
|
|
# this automatically, because there gunicorn binds loopback behind our nginx.
|
|
#
|
|
# TRUSTED_PROXY_HOPS = proxies in front of Flask. Your proxy alone = 1; your
|
|
# proxy plus ServerKit's nginx = 2; add Cloudflare on top and it goes up again.
|
|
TRUST_PROXY_HEADERS=false
|
|
TRUSTED_PROXY_HOPS=1
|
|
|
|
# ----------------------------------------
|
|
# Login brute-force throttle (per client IP)
|
|
# ----------------------------------------
|
|
# On top of the per-user account lockout, block a client IP after too many
|
|
# failed logins (defends against password-spraying across many usernames).
|
|
# Defaults shown; override only if you need to tune them.
|
|
# AUTH_IP_MAX_ATTEMPTS=10
|
|
# AUTH_IP_WINDOW_MINUTES=15
|
|
# AUTH_IP_BLOCK_MINUTES=15
|
|
|
|
# ----------------------------------------
|
|
# Rate-limit storage backend
|
|
# ----------------------------------------
|
|
# Default is in-memory, which matches the deliberate single-worker gunicorn
|
|
# design (see docs/ARCHITECTURE.md). Point at Redis to share limit state
|
|
# across processes and silence flask-limiter's in-memory production warning.
|
|
# RATELIMIT_STORAGE_URI=redis://localhost:6379/0
|
|
|
|
# ----------------------------------------
|
|
# Environment
|
|
# ----------------------------------------
|
|
# Options: development, production
|
|
FLASK_ENV=production
|
|
|
|
# ----------------------------------------
|
|
# GitHub Repository (for agent downloads)
|
|
# ----------------------------------------
|
|
# This is used to fetch agent releases for the downloads page
|
|
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit
|
|
|
|
# ----------------------------------------
|
|
# Theme Registry
|
|
# ----------------------------------------
|
|
# Curated theme index for the Browse gallery. Unset = the public registry
|
|
# (https://serverkit.ai/themes/index.json); set-but-empty = disabled (bundled
|
|
# themes only).
|
|
# SERVERKIT_THEMES_REGISTRY_URL=https://serverkit.ai/themes/index.json
|
|
# Seconds to cache the registry index before re-fetching (default 3600).
|
|
# SERVERKIT_THEMES_REGISTRY_TTL=3600
|
|
|
|
# ----------------------------------------
|
|
# Optional: Notification Webhooks
|
|
# ----------------------------------------
|
|
# These can also be configured via the web UI at Settings > Notifications
|
|
|
|
# Discord Webhook URL
|
|
# DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
|
|
|
|
# Slack Webhook URL
|
|
# SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
|
|
|
|
# Telegram Bot
|
|
# TELEGRAM_BOT_TOKEN=your-bot-token
|
|
# TELEGRAM_CHAT_ID=your-chat-id
|
|
|
|
# ----------------------------------------
|
|
# Security opt-ins & special modes
|
|
# ----------------------------------------
|
|
|
|
# Allow installed extensions to pip-install the Python requirements they ship.
|
|
# Off by default: pip runs with the backend's privileges.
|
|
# SERVERKIT_ALLOW_PLUGIN_PIP=false
|
|
|
|
# Allow extension downloads from non-HTTPS / private-network URLs.
|
|
# SERVERKIT_ALLOW_PRIVATE_DOWNLOADS=false
|
|
|
|
# Read-only demo panel (mutating API calls are refused).
|
|
# SERVERKIT_DEMO_MODE=false
|
|
|
|
# Stream simulated deploys through the real deploy pipeline (no Docker needed).
|
|
# SERVERKIT_DEMO_DEPLOYS=false
|
|
|
|
# Mark this panel as a staging install (reported by /health).
|
|
# SERVERKIT_STAGING=false
|
|
|
|
# Add request duration, SQL duration and statement count to Server-Timing.
|
|
# Temporary local/staging diagnosis; disabled by default. No SQL text is emitted.
|
|
# SERVERKIT_PROFILE_REQUESTS=false
|