mirror of
https://github.com/Zproger/Aurum.git
synced 2026-10-12 18:46:40 +07:00
14948aff1d
- TLS через подключаемый overlay docker-compose.tls.yml + Caddyfile: Caddy сам получает и продлевает сертификат Let's Encrypt, HSTS добавляется на уровне прокси — намеренно там, а не в nginx.conf, иначе установки без TLS заперли бы сами себя; - проверка заголовка Host против DNS rebinding: AURUM_ALLOWED_HOSTS, по умолчанию localhost и 127.0.0.1, чужой Host получает 421 с подсказкой, какую переменную поправить; - «запомнить меня на 7 дней» вернулось в безопасном виде: пароль шифруется AES-GCM ключом с extractable: false в IndexedDB, вместо прежнего base64 в localStorage, который разворачивался обратно в пароль одним atob. Требует secure context, поэтому по обычному HTTP к LAN-адресу чекбокс не показывается, а не притворяется рабочим; - аудит-лог необратимых операций (восстановление бэкапа, массовое создание транзакций, удаление счёта) в лог контейнера. Не в БД сознательно: таблица аудита исчезла бы ровно в том событии, которое должна объяснять; - README: раздел про TLS и таблица двух переменных, решающих, кто может достучаться до инстанса.
75 lines
3.7 KiB
Plaintext
75 lines
3.7 KiB
Plaintext
# Copy this file to .env and adjust values before running `docker compose up`.
|
|
|
|
# --- Postgres ---
|
|
# IMPORTANT, and easy to get wrong: Postgres only applies this password when
|
|
# it FIRST creates its data directory. Change it later and the running
|
|
# database keeps the old one — the value here and the value in the database
|
|
# drift apart, and the backend starts failing to connect with a password
|
|
# authentication error that looks like it came out of nowhere. So set it
|
|
# before the first `docker compose up`. Changing it afterwards means either
|
|
# ALTER USER inside the running database, or deleting the aurum_pgdata volume
|
|
# (which deletes all your data — export a backup from Settings first).
|
|
#
|
|
# The database is not published to your host machine (no ports mapping for the
|
|
# db service), so it's only reachable from inside the container network.
|
|
AURUM_POSTGRES_USER=aurum
|
|
AURUM_POSTGRES_PASSWORD=change-me
|
|
AURUM_POSTGRES_DB=aurum
|
|
AURUM_POSTGRES_HOST=db
|
|
AURUM_POSTGRES_PORT=5432
|
|
|
|
# --- Backend ---
|
|
# Comma-separated list of browser origins allowed to call the API. Leave it
|
|
# empty unless you serve the frontend from a different origin than the API:
|
|
# docker compose serves both from the same nginx, and the Vite dev server
|
|
# proxies /api, so neither needs this. "*" is honoured but then credentials
|
|
# are never granted, because "*" plus credentials lets any site you visit
|
|
# read this instance.
|
|
AURUM_CORS_ORIGINS=
|
|
AURUM_DEFAULT_CURRENCY=USD
|
|
|
|
# --- Crypto tab (live prices via CoinGecko) ---
|
|
# Free Demo API key, no card required: coingecko.com/en/api/pricing. Leave
|
|
# blank and the Crypto tab's price sync just 400s with a message telling
|
|
# you to set this — nothing else in the app is affected.
|
|
AURUM_COINGECKO_API_KEY=
|
|
|
|
# Swagger UI / ReDoc / openapi.json at /api/docs. Left on: the REST API is a
|
|
# documented feature (see DOCS.md), and when basic auth is configured these
|
|
# sit behind it like every other /api/ route. Set it to false on an instance
|
|
# that's reachable from the internet without basic auth — an open
|
|
# openapi.json is a complete machine-readable map of every endpoint.
|
|
AURUM_ENABLE_DOCS=true
|
|
|
|
# --- Basic auth (STRONGLY recommended if this instance is reachable from
|
|
# anywhere other than your own machine) ---
|
|
# Aurum has no login system of its own — it's built for one person
|
|
# self-hosting their own private instance, not a multi-tenant service.
|
|
# Leave both blank and there is NO password on this app at all: anyone who
|
|
# can reach it can read, edit, and delete every transaction, account, and
|
|
# asset. Set both to put an HTTP Basic Auth prompt in front of the whole
|
|
# app (UI + API). See frontend/docker-entrypoint.d/20-basic-auth.sh.
|
|
AURUM_BASIC_AUTH_USER=
|
|
AURUM_BASIC_AUTH_PASSWORD=
|
|
|
|
# --- Ports exposed on your host machine ---
|
|
AURUM_WEB_PORT=3000
|
|
|
|
# Which host interface Aurum listens on. The default, 127.0.0.1, means "this
|
|
# machine only" — nothing else on your network can reach it. Change it to
|
|
# 0.0.0.0 to open it up (phone on the same Wi-Fi, another PC, a reverse
|
|
# proxy), but set the basic auth variables above first: without them the app
|
|
# has no password, and this is the line that decides who can knock.
|
|
AURUM_BIND_ADDRESS=127.0.0.1
|
|
|
|
# Hostnames Aurum will answer to, space- or comma-separated. Anything else
|
|
# gets a 421 with a message telling you to edit this line. It exists to block
|
|
# DNS rebinding: a site you're visiting can point its own domain at
|
|
# 127.0.0.1 and then read your instance through your own browser — the Host
|
|
# header is what gives it away.
|
|
#
|
|
# If you opened AURUM_BIND_ADDRESS above, add whatever you type in the
|
|
# address bar here too: the LAN IP (192.168.1.50), your domain
|
|
# (aurum.example.com), a .local name. Set it to * to turn the check off.
|
|
AURUM_ALLOWED_HOSTS=localhost 127.0.0.1
|