mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 05:24:49 +09:00
Juan Denis
5fd04bbfb0
Introduces a new `.coderabbit.yaml` with ServerKit-specific review guardrails, and expands env/security documentation for trusted proxy headers and per-IP login brute-force throttling. It also adds inline backend notes clarifying `request.remote_addr` behavior under ProxyFix for auth, cron, and pairing paths, and updates the frontend plugin manifest to remove the Tramo and K8s plugin entries.
62 lines
2.6 KiB
Bash
62 lines
2.6 KiB
Bash
# Flask Configuration
|
|
FLASK_ENV=development
|
|
|
|
# IMPORTANT: Generate secure keys for production!
|
|
# Run: python -c "import secrets; print(secrets.token_hex(32))"
|
|
SECRET_KEY=change-this-to-a-secure-random-string
|
|
|
|
# Database
|
|
DATABASE_URL=sqlite:///serverkit.db
|
|
|
|
# JWT Configuration
|
|
# IMPORTANT: Generate a unique key for production!
|
|
# Run: python -c "import secrets; print(secrets.token_hex(32))"
|
|
JWT_SECRET_KEY=change-this-to-another-secure-random-string
|
|
|
|
# CORS - comma-separated list of allowed origins
|
|
CORS_ORIGINS=http://localhost:41921,http://127.0.0.1:41921,http://localhost:47927,http://127.0.0.1:47927
|
|
|
|
# Server
|
|
PORT=47927
|
|
|
|
# Trusted reverse proxy (client IP)
|
|
# Default OFF for local dev: run.py is directly exposed with no proxy, so an
|
|
# X-Forwarded-For header would be client-forgeable and must NOT be trusted.
|
|
# In production the panel sits behind its bundled nginx — set this to true there
|
|
# (the shipped .env.example does) so ServerKit derives the real client IP via
|
|
# ProxyFix for rate-limiting / login lockout / audit logs. TRUSTED_PROXY_HOPS is
|
|
# the number of proxies in front of Flask (bundled nginx = 1).
|
|
# TRUST_PROXY_HEADERS=false
|
|
# TRUSTED_PROXY_HOPS=1
|
|
|
|
# Login brute-force throttle (per client IP), on top of per-user lockout.
|
|
# Defaults shown; uncomment to tune.
|
|
# AUTH_IP_MAX_ATTEMPTS=10
|
|
# AUTH_IP_WINDOW_MINUTES=15
|
|
# AUTH_IP_BLOCK_MINUTES=15
|
|
|
|
# Security - Agent API Secret Encryption
|
|
# IMPORTANT: Generate a unique key for production!
|
|
# Run: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
# Or: python -c "import base64; import os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())"
|
|
SERVERKIT_ENCRYPTION_KEY= # Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
|
|
# GitHub Repository for agent releases (owner/repo format)
|
|
# This is used to fetch the latest agent version for the downloads page
|
|
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit
|
|
|
|
# Dev path overrides (uncomment for local development)
|
|
# Production defaults are absolute Linux paths (/var/serverkit, /etc/serverkit, etc.)
|
|
# SERVERKIT_DIR=./dev-data
|
|
# SERVERKIT_CONFIG_DIR=./dev-data/config
|
|
# SERVERKIT_LOG_DIR=./dev-data/logs
|
|
# SERVERKIT_BACKUP_DIR=./dev-data/backups
|
|
# SERVERKIT_CACHE_DIR=./dev-data/cache
|
|
# SERVERKIT_QUARANTINE_DIR=./dev-data/quarantine
|
|
|
|
# Public URL agents should dial back to. Set this whenever the panel sits
|
|
# behind a reverse proxy / tunnel / custom domain — the connection string
|
|
# the panel issues to agents will embed this URL instead of the request's
|
|
# Host header (which would otherwise be the internal IP/port).
|
|
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com
|