Pouzor
dbfc8a2a32
C3 - config.yml contains credentials, remove from git tracking:
- Add backend/config.yml to .gitignore
- git rm --cached to untrack it
- Add backend/config.yml.example with instructions
C1 - SECRET_KEY must come from .env, no unsafe default:
- Remove hardcoded "change_me_in_production" default from config.py
- App now fails to start if SECRET_KEY is not set (pydantic required field)
- Generate real random key in backend/.env (gitignored)
- Add backend/.env.example for new contributors
H1 - WebSocket /ws/status was unauthenticated:
- Backend: require ?token= query param, validate via decode_token(),
close with code 1008 (Policy Violation) if missing or invalid
- Frontend: append ?token=<jwt> to WebSocket URL
18 lines
514 B
Python
18 lines
514 B
Python
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8")
|
|
|
|
secret_key: str # Required — set SECRET_KEY in .env
|
|
sqlite_path: str = "./data/homelab.db"
|
|
config_path: str = "./config.yml"
|
|
cors_origins: list[str] = ["http://localhost:5173", "http://localhost:3000"]
|
|
|
|
# JWT
|
|
algorithm: str = "HS256"
|
|
access_token_expire_minutes: int = 1440 # 24h
|
|
|
|
|
|
settings = Settings()
|