SmartUp Developer
ad16618406
- CORS: replace wildcard with explicit origin list from CORS_ORIGINS env - Auth: enforce strong defaults, JWT blacklist (RevokedToken model), login rate limiting - Auth: validate password length before bcrypt (72-byte limit) - Scheduler: single-threaded worker to mitigate SQLite write contention - Scheduler: graceful shutdown (wait=True) - Snapshots: add prune_snapshots() with configurable retention count - Storage: isolate localStorage keys via VITE_APP_KEY prefix - Config: add cors_origins, login_rate_limit, snapshot_retention_count settings
25 lines
770 B
Bash
25 lines
770 B
Bash
# ===== 必填 =====
|
||
# 管理员账号（首次启动自动创建）
|
||
ADMIN_EMAIL=admin@smartup.local
|
||
ADMIN_PASSWORD=replace-with-a-strong-password
|
||
|
||
# ===== 推荐配置 =====
|
||
# JWT 签名密钥: openssl rand -hex 32
|
||
JWT_SECRET=replace-with-openssl-rand-hex-32
|
||
# 允许访问 API 的前端源，多个用逗号分隔
|
||
CORS_ORIGINS=http://localhost:8899,http://127.0.0.1:8899
|
||
|
||
# ===== 可选 =====
|
||
# 监听端口（默认 8899）
|
||
SERVER_PORT=8899
|
||
# 绑定地址（默认 0.0.0.0）
|
||
BIND_HOST=0.0.0.0
|
||
# 时区
|
||
TZ=Asia/Shanghai
|
||
# 连续失败多少次判定为 unhealthy（默认 3）
|
||
UNHEALTHY_THRESHOLD=3
|
||
# 远程浏览器 profile 存储目录
|
||
BROWSER_PROFILES_DIR=/app/data/browser-profiles
|
||
# 生产环境通常保持 true；调试时可改为 false
|
||
BROWSER_HEADLESS=true
|