mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-30 08:36:55 +09:00
Juan Denis
5fd04bbfb0
Introduces a new `.coderabbit.yaml` with ServerKit-specific review guardrails, and expands env/security documentation for trusted proxy headers and per-IP login brute-force throttling. It also adds inline backend notes clarifying `request.remote_addr` behavior under ProxyFix for auth, cron, and pairing paths, and updates the frontend plugin manifest to remove the Tramo and K8s plugin entries.
96 lines
3.6 KiB
Bash
96 lines
3.6 KiB
Bash
# ============================================
|
|
# ServerKit Configuration
|
|
# ============================================
|
|
# Copy this file to .env and customize for your environment
|
|
# Generate secure keys with: python -c "import secrets; print(secrets.token_hex(32))"
|
|
# ============================================
|
|
|
|
# ----------------------------------------
|
|
# REQUIRED: Security Keys
|
|
# ----------------------------------------
|
|
# Generate unique keys for production!
|
|
SECRET_KEY=your-secret-key-here
|
|
JWT_SECRET_KEY=your-jwt-secret-key-here
|
|
# Fernet key for encrypting secrets at rest.
|
|
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
SERVERKIT_ENCRYPTION_KEY=your-fernet-key-here
|
|
|
|
# ----------------------------------------
|
|
# Database Configuration
|
|
# ----------------------------------------
|
|
# SQLite (default - good for small deployments):
|
|
DATABASE_URL=sqlite:///serverkit.db
|
|
|
|
# PostgreSQL (recommended for production):
|
|
# DATABASE_URL=postgresql://user:password@localhost:5432/serverkit
|
|
|
|
# MySQL:
|
|
# DATABASE_URL=mysql://user:password@localhost:3306/serverkit
|
|
|
|
# ----------------------------------------
|
|
# Network Configuration
|
|
# ----------------------------------------
|
|
# CORS Origins - your domain(s), comma-separated
|
|
CORS_ORIGINS=http://localhost,https://your-domain.com
|
|
|
|
# Public URL that agents should dial back to. Set this whenever the panel
|
|
# sits behind a reverse proxy / tunnel / custom domain — the connection
|
|
# string the panel issues to agents will embed this URL instead of the
|
|
# request's Host header (which would otherwise be the internal IP/port).
|
|
# Leave commented out for plain localhost development.
|
|
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com
|
|
|
|
# Ports (for Docker)
|
|
PORT=80
|
|
SSL_PORT=443
|
|
|
|
# ----------------------------------------
|
|
# Trusted reverse proxy (client IP)
|
|
# ----------------------------------------
|
|
# The panel runs behind its bundled nginx, so the real client IP arrives in
|
|
# X-Forwarded-For and the raw socket peer is nginx. Enable this so ServerKit
|
|
# trusts the proxy and derives the real client IP (via Werkzeug ProxyFix) for
|
|
# rate-limiting, login lockout and audit logs. Leave it FALSE / unset only for
|
|
# a directly-exposed server with no proxy in front (otherwise a client could
|
|
# forge X-Forwarded-For). TRUSTED_PROXY_HOPS = number of proxies in front of
|
|
# Flask (bundled nginx = 1; raise it if you add e.g. Cloudflare on top).
|
|
TRUST_PROXY_HEADERS=true
|
|
TRUSTED_PROXY_HOPS=1
|
|
|
|
# ----------------------------------------
|
|
# Login brute-force throttle (per client IP)
|
|
# ----------------------------------------
|
|
# On top of the per-user account lockout, block a client IP after too many
|
|
# failed logins (defends against password-spraying across many usernames).
|
|
# Defaults shown; override only if you need to tune them.
|
|
# AUTH_IP_MAX_ATTEMPTS=10
|
|
# AUTH_IP_WINDOW_MINUTES=15
|
|
# AUTH_IP_BLOCK_MINUTES=15
|
|
|
|
# ----------------------------------------
|
|
# Environment
|
|
# ----------------------------------------
|
|
# Options: development, production
|
|
FLASK_ENV=production
|
|
|
|
# ----------------------------------------
|
|
# GitHub Repository (for agent downloads)
|
|
# ----------------------------------------
|
|
# This is used to fetch agent releases for the downloads page
|
|
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit
|
|
|
|
# ----------------------------------------
|
|
# Optional: Notification Webhooks
|
|
# ----------------------------------------
|
|
# These can also be configured via the web UI at Settings > Notifications
|
|
|
|
# Discord Webhook URL
|
|
# DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
|
|
|
|
# Slack Webhook URL
|
|
# SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
|
|
|
|
# Telegram Bot
|
|
# TELEGRAM_BOT_TOKEN=your-bot-token
|
|
# TELEGRAM_CHAT_ID=your-chat-id
|