brunorezioandClaude Opus 5
8163f04420
Origin validation, every rate limiter and the password-strength check each treated an unset PUBLIC_BUILD_ENV as "relaxed", so a deployment that forgot the variable silently ran with CORS reflecting any origin, no brute-force limit on the sole account, and no password rules. setup.sh writes it, but .env.example never mentioned it. The three now share IS_DEV_BUILD, which is true only when PUBLIC_BUILD_ENV is explicitly "dev" or "development". Anything else, including unset, is hardened. Documented in .env.example. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
16 lines
614 B
Bash
16 lines
614 B
Bash
PORT=9000
|
|
JWT_SECRET="<generate with: openssl rand -base64 32>"
|
|
POSTGRES_URL="postgres://postgres:password@localhost:5432/officer"
|
|
MAIL_TRANSPORT="smtp://localhost:1025"
|
|
PUBLIC_URL=http://localhost:9000
|
|
|
|
# Guards (CORS origin checks, rate limits, password-strength rules) are ON unless this is set to
|
|
# "dev" or "development". Leave it unset or set it to "production" for a real deployment; only set
|
|
# it to "dev" on a local machine you trust, since that disables all three.
|
|
PUBLIC_BUILD_ENV=production
|
|
|
|
DATA_PATH=/path/to/data
|
|
OFFICER_ITEMS_DIR=/path/to/officer-items
|
|
HOME_DIR=/home/user
|
|
BROWSER_RELAY_PORT=18792
|