mirror of
https://github.com/Zproger/Aurum.git
synced 2026-10-13 02:56:39 +07:00
f9413aa6e1
Конфигурация и эксплуатационный слой: - nginx: client_max_body_size 64m — восстановление из бэкапа не работало вовсе, дефолтный лимит в 1 МБ резал дампы (реальный экспорт ~3.4 МБ) с 413 ещё до backend; - nginx: заголовки безопасности (nosniff, Referrer-Policy, Permissions-Policy) и полный Content-Security-Policy. Ради него inline-скрипт темы вынесен в public/theme-init.js; - nginx: limit_req на /api/ — перебор пароля Basic Auth шёл со скоростью сети, ни блокировки, ни задержки не было; - nginx: server_tokens off; - порт web привязан к 127.0.0.1, адрес настраивается через AURUM_BIND_ADDRESS (раньше слушался на всех интерфейсах); - backend работает от непривилегированного пользователя, no-new-privileges для backend и web; - дефолты пароля Postgres сведены к одному значению в обоих сервисах, в .env.example описана ловушка с инициализацией тома. Приложение: - версия убрана из неавторизованного /api/health и отдаётся как app_version в GET /api/settings; - /api/docs, /api/redoc и /api/openapi.json отключаются через AURUM_ENABLE_DOCS; - текст исключения при неудачном восстановлении уходит в лог, а не клиенту; - max_length для notes в схемах транзакций, активов и регулярных платежей (и в соответствующих полях UI); - срок «запомнить меня» сокращён с 30 дней до 7; - pytest обновлён до 9.0.3 (PYSEC-2026-1845), pytest-asyncio до 1.4.0; - CI: permissions contents:read для GITHUB_TOKEN.
64 lines
3.1 KiB
Plaintext
64 lines
3.1 KiB
Plaintext
# Copy this file to .env and adjust values before running `docker compose up`.
|
|
|
|
# --- Postgres ---
|
|
# IMPORTANT, and easy to get wrong: Postgres only applies this password when
|
|
# it FIRST creates its data directory. Change it later and the running
|
|
# database keeps the old one — the value here and the value in the database
|
|
# drift apart, and the backend starts failing to connect with a password
|
|
# authentication error that looks like it came out of nowhere. So set it
|
|
# before the first `docker compose up`. Changing it afterwards means either
|
|
# ALTER USER inside the running database, or deleting the aurum_pgdata volume
|
|
# (which deletes all your data — export a backup from Settings first).
|
|
#
|
|
# The database is not published to your host machine (no ports mapping for the
|
|
# db service), so it's only reachable from inside the container network.
|
|
AURUM_POSTGRES_USER=aurum
|
|
AURUM_POSTGRES_PASSWORD=change-me
|
|
AURUM_POSTGRES_DB=aurum
|
|
AURUM_POSTGRES_HOST=db
|
|
AURUM_POSTGRES_PORT=5432
|
|
|
|
# --- Backend ---
|
|
# Comma-separated list of browser origins allowed to call the API. Leave it
|
|
# empty unless you serve the frontend from a different origin than the API:
|
|
# docker compose serves both from the same nginx, and the Vite dev server
|
|
# proxies /api, so neither needs this. "*" is honoured but then credentials
|
|
# are never granted, because "*" plus credentials lets any site you visit
|
|
# read this instance.
|
|
AURUM_CORS_ORIGINS=
|
|
AURUM_DEFAULT_CURRENCY=USD
|
|
|
|
# --- Crypto tab (live prices via CoinGecko) ---
|
|
# Free Demo API key, no card required: coingecko.com/en/api/pricing. Leave
|
|
# blank and the Crypto tab's price sync just 400s with a message telling
|
|
# you to set this — nothing else in the app is affected.
|
|
AURUM_COINGECKO_API_KEY=
|
|
|
|
# Swagger UI / ReDoc / openapi.json at /api/docs. Left on: the REST API is a
|
|
# documented feature (see DOCS.md), and when basic auth is configured these
|
|
# sit behind it like every other /api/ route. Set it to false on an instance
|
|
# that's reachable from the internet without basic auth — an open
|
|
# openapi.json is a complete machine-readable map of every endpoint.
|
|
AURUM_ENABLE_DOCS=true
|
|
|
|
# --- Basic auth (STRONGLY recommended if this instance is reachable from
|
|
# anywhere other than your own machine) ---
|
|
# Aurum has no login system of its own — it's built for one person
|
|
# self-hosting their own private instance, not a multi-tenant service.
|
|
# Leave both blank and there is NO password on this app at all: anyone who
|
|
# can reach it can read, edit, and delete every transaction, account, and
|
|
# asset. Set both to put an HTTP Basic Auth prompt in front of the whole
|
|
# app (UI + API). See frontend/docker-entrypoint.d/20-basic-auth.sh.
|
|
AURUM_BASIC_AUTH_USER=
|
|
AURUM_BASIC_AUTH_PASSWORD=
|
|
|
|
# --- Ports exposed on your host machine ---
|
|
AURUM_WEB_PORT=3000
|
|
|
|
# Which host interface Aurum listens on. The default, 127.0.0.1, means "this
|
|
# machine only" — nothing else on your network can reach it. Change it to
|
|
# 0.0.0.0 to open it up (phone on the same Wi-Fi, another PC, a reverse
|
|
# proxy), but set the basic auth variables above first: without them the app
|
|
# has no password, and this is the line that decides who can knock.
|
|
AURUM_BIND_ADDRESS=127.0.0.1
|