a895bebdc2
Two HIGH deployment fixes found in the go-live review, plus two cheap backstops. HIGH 1 — Postgres was published to the public internet. The committed, auto-merged docker-compose.override.yml mapped 5432:5432 on 0.0.0.0 (and a Docker publish bypasses ufw), so a `docker compose up` on the prod host exposed the DB with the .env password. Bind the dev port to 127.0.0.1 so it's reachable only from the host's loopback even when the override lands in prod. .env.example also stops shipping `secret` as the DB password (now CHANGE_ME_*). HIGH 2 — the JWT-secret production guard was inert. APP_ENV was never set to production (defaulted to development), so the guard never ran; and it only matched one stale dev sentinel, not the `.env.example` placeholder that an operator is most likely to leave in place. Now: docker-compose.yml forces APP_ENV=production on the app service, and config.rs refuses to boot in production on any placeholder (change/example/placeholder/replace) or any secret < 64 chars. Verified: placeholder and short secrets are rejected; a 128-char secret passes. This turns "looks protected" into actually protected. Backstops: - frontend container now runs as the non-root `node` user (the backend was already hardened; the frontend wasn't). - app gets mem_limit 3g so a miss in the in-app upload RAM caps OOM-kills the container instead of the 8 GB host. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
52 lines
3.5 KiB
Plaintext
52 lines
3.5 KiB
Plaintext
# ── Domain ────────────────────────────────────────────────────────────────────
|
||
# Public domain Caddy will serve and obtain a TLS certificate for.
|
||
DOMAIN=my-event.example.com
|
||
|
||
# ── App server ────────────────────────────────────────────────────────────────
|
||
APP_PORT=3000
|
||
# docker-compose.yml already forces APP_ENV=production for the `app` service.
|
||
# Only set this for a non-compose (bare cargo) run; leave unset for local dev.
|
||
# APP_ENV=production
|
||
|
||
# ── Database ──────────────────────────────────────────────────────────────────
|
||
# Set a strong password and keep it identical in DATABASE_URL and POSTGRES_PASSWORD.
|
||
DATABASE_URL=postgres://eventsnap:CHANGE_ME_strong_db_password@db:5432/eventsnap
|
||
POSTGRES_USER=eventsnap
|
||
POSTGRES_PASSWORD=CHANGE_ME_strong_db_password
|
||
POSTGRES_DB=eventsnap
|
||
|
||
# ── Authentication ────────────────────────────────────────────────────────────
|
||
# REQUIRED in production: generate with `openssl rand -hex 64` (128 hex chars).
|
||
# The backend refuses to start in production with this placeholder or any value
|
||
# that is short or contains change/example/placeholder/replace.
|
||
JWT_SECRET=change_me_to_a_random_64_byte_hex_string
|
||
SESSION_EXPIRY_DAYS=30
|
||
|
||
# Admin dashboard password (bcrypt hash).
|
||
# Generate with: htpasswd -bnBC 12 "" yourpassword | tr -d ':\n'
|
||
ADMIN_PASSWORD_HASH=$2y$12$placeholder_replace_me
|
||
|
||
# ── Event ─────────────────────────────────────────────────────────────────────
|
||
EVENT_NAME=Max & Maria's Wedding
|
||
EVENT_SLUG=max-maria-2026
|
||
|
||
# ── Storage ───────────────────────────────────────────────────────────────────
|
||
MEDIA_PATH=/media
|
||
|
||
# ── Upload limits ─────────────────────────────────────────────────────────────
|
||
DEFAULT_MAX_IMAGE_SIZE_MB=20
|
||
DEFAULT_MAX_VIDEO_SIZE_MB=500
|
||
|
||
# ── Rate limiting ─────────────────────────────────────────────────────────────
|
||
DEFAULT_UPLOAD_RATE_PER_HOUR=10
|
||
DEFAULT_FEED_RATE_PER_MIN=60
|
||
DEFAULT_EXPORT_RATE_PER_DAY=3
|
||
|
||
# ── Capacity ──────────────────────────────────────────────────────────────────
|
||
DEFAULT_ESTIMATED_GUEST_COUNT=100
|
||
# Fraction of total storage that triggers the "low storage" warning (0.0–1.0)
|
||
DEFAULT_QUOTA_TOLERANCE=0.75
|
||
|
||
# ── Workers ───────────────────────────────────────────────────────────────────
|
||
COMPRESSION_WORKER_CONCURRENCY=2
|