mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-29 16:17:25 +09:00
Juan Denis
ad96423966
- Validate preview swatches as colors server-side (closes url() smuggling via POST /import); import tolerates unknown metadata (license, image, modes) - theme_registry_service: negative caching on fetch failure (TTL-stamped last-good + 60s failure backoff — no more 15s gallery stalls offline); drop dead base_url cache key; refresh stale comment - .env.example: document SERVERKIT_THEMES_REGISTRY_URL/_TTL - SCSS: route $success/$warning/$danger/$info through --green/--amber/ --red/--cyan (raw twins for color-function call sites), $font-main/$font-mono through --sans/--mono, scrollbar track through --scrollbar-track - Fix 5 undefined CSS var consumers (--radius-md/--card-bg/--danger/ --accent-subtle/--accent-soft -> existing tokens) - Nits: drop dead ThemeStudioTrigger export, dedupe lucide import, run check-theme-tokens in pre-commit hook - docs/plans/61_THEMES_HARDENING_PLAN.md 23 backend theme tests pass; check-theme-tokens, lint (0 errors), build green
106 lines
4.1 KiB
Bash
106 lines
4.1 KiB
Bash
# ============================================
|
|
# ServerKit Configuration
|
|
# ============================================
|
|
# Copy this file to .env and customize for your environment
|
|
# Generate secure keys with: python -c "import secrets; print(secrets.token_hex(32))"
|
|
# ============================================
|
|
|
|
# ----------------------------------------
|
|
# REQUIRED: Security Keys
|
|
# ----------------------------------------
|
|
# Generate unique keys for production!
|
|
SECRET_KEY=your-secret-key-here
|
|
JWT_SECRET_KEY=your-jwt-secret-key-here
|
|
# Fernet key for encrypting secrets at rest.
|
|
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
SERVERKIT_ENCRYPTION_KEY=your-fernet-key-here
|
|
|
|
# ----------------------------------------
|
|
# Database Configuration
|
|
# ----------------------------------------
|
|
# SQLite (default - good for small deployments):
|
|
DATABASE_URL=sqlite:///serverkit.db
|
|
|
|
# PostgreSQL (recommended for production):
|
|
# DATABASE_URL=postgresql://user:password@localhost:5432/serverkit
|
|
|
|
# MySQL:
|
|
# DATABASE_URL=mysql://user:password@localhost:3306/serverkit
|
|
|
|
# ----------------------------------------
|
|
# Network Configuration
|
|
# ----------------------------------------
|
|
# CORS Origins - your domain(s), comma-separated
|
|
CORS_ORIGINS=http://localhost,https://your-domain.com
|
|
|
|
# Public URL that agents should dial back to. Set this whenever the panel
|
|
# sits behind a reverse proxy / tunnel / custom domain — the connection
|
|
# string the panel issues to agents will embed this URL instead of the
|
|
# request's Host header (which would otherwise be the internal IP/port).
|
|
# Leave commented out for plain localhost development.
|
|
# SERVERKIT_PUBLIC_URL=https://panel.your-domain.com
|
|
|
|
# Ports (for Docker)
|
|
PORT=80
|
|
SSL_PORT=443
|
|
|
|
# ----------------------------------------
|
|
# Trusted reverse proxy (client IP)
|
|
# ----------------------------------------
|
|
# The panel runs behind its bundled nginx, so the real client IP arrives in
|
|
# X-Forwarded-For and the raw socket peer is nginx. Enable this so ServerKit
|
|
# trusts the proxy and derives the real client IP (via Werkzeug ProxyFix) for
|
|
# rate-limiting, login lockout and audit logs. Leave it FALSE / unset only for
|
|
# a directly-exposed server with no proxy in front (otherwise a client could
|
|
# forge X-Forwarded-For). TRUSTED_PROXY_HOPS = number of proxies in front of
|
|
# Flask (bundled nginx = 1; raise it if you add e.g. Cloudflare on top).
|
|
TRUST_PROXY_HEADERS=true
|
|
TRUSTED_PROXY_HOPS=1
|
|
|
|
# ----------------------------------------
|
|
# Login brute-force throttle (per client IP)
|
|
# ----------------------------------------
|
|
# On top of the per-user account lockout, block a client IP after too many
|
|
# failed logins (defends against password-spraying across many usernames).
|
|
# Defaults shown; override only if you need to tune them.
|
|
# AUTH_IP_MAX_ATTEMPTS=10
|
|
# AUTH_IP_WINDOW_MINUTES=15
|
|
# AUTH_IP_BLOCK_MINUTES=15
|
|
|
|
# ----------------------------------------
|
|
# Environment
|
|
# ----------------------------------------
|
|
# Options: development, production
|
|
FLASK_ENV=production
|
|
|
|
# ----------------------------------------
|
|
# GitHub Repository (for agent downloads)
|
|
# ----------------------------------------
|
|
# This is used to fetch agent releases for the downloads page
|
|
SERVERKIT_GITHUB_REPO=jhd3197/ServerKit
|
|
|
|
# ----------------------------------------
|
|
# Theme Registry
|
|
# ----------------------------------------
|
|
# Curated theme index for the Browse gallery. Unset = the public registry
|
|
# (https://serverkit.ai/themes/index.json); set-but-empty = disabled (bundled
|
|
# themes only).
|
|
# SERVERKIT_THEMES_REGISTRY_URL=https://serverkit.ai/themes/index.json
|
|
# Seconds to cache the registry index before re-fetching (default 3600).
|
|
# SERVERKIT_THEMES_REGISTRY_TTL=3600
|
|
|
|
# ----------------------------------------
|
|
# Optional: Notification Webhooks
|
|
# ----------------------------------------
|
|
# These can also be configured via the web UI at Settings > Notifications
|
|
|
|
# Discord Webhook URL
|
|
# DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
|
|
|
|
# Slack Webhook URL
|
|
# SLACK_WEBHOOK_URL=https://hooks.slack.com/services/...
|
|
|
|
# Telegram Bot
|
|
# TELEGRAM_BOT_TOKEN=your-bot-token
|
|
# TELEGRAM_CHAT_ID=your-chat-id
|