Pouzor
dbfc8a2a32
C3 - config.yml contains credentials, remove from git tracking:
- Add backend/config.yml to .gitignore
- git rm --cached to untrack it
- Add backend/config.yml.example with instructions
C1 - SECRET_KEY must come from .env, no unsafe default:
- Remove hardcoded "change_me_in_production" default from config.py
- App now fails to start if SECRET_KEY is not set (pydantic required field)
- Generate real random key in backend/.env (gitignored)
- Add backend/.env.example for new contributors
H1 - WebSocket /ws/status was unauthenticated:
- Backend: require ?token= query param, validate via decode_token(),
close with code 1008 (Policy Violation) if missing or invalid
- Frontend: append ?token=<jwt> to WebSocket URL
5 lines
208 B
Bash
5 lines
208 B
Bash
SECRET_KEY=<generate with: python3 -c "import secrets; print(secrets.token_urlsafe(32))">
|
|
SQLITE_PATH=./data/homelab.db
|
|
CONFIG_PATH=./config.yml
|
|
CORS_ORIGINS=["http://localhost:5173","http://localhost:3000"]
|