Dmitry
600496048f
get_current_user навешивается на роутер целиком, публичными остаются только health и auth (список закреплён tests/api/test_route_auth.py). API не стартует с плейсхолдером или коротким JWT_SECRET без ALLOW_DEV_SECRET=1. Лимитер логинов ограничен по числу ключей. Клиентский IP берётся из последнего хопа X-Forwarded-For.
27 lines
853 B
Bash
27 lines
853 B
Bash
# Copy to .env (never committed). On the VPS, docker compose reads this file.
|
|
|
|
# --- database ---
|
|
POSTGRES_DB=fintracker
|
|
POSTGRES_USER=fintracker
|
|
POSTGRES_PASSWORD=change-me
|
|
# used by api/worker; inside compose the host is `db`
|
|
DATABASE_URL=postgresql+asyncpg://fintracker:change-me@db:5432/fintracker
|
|
|
|
# --- auth ---
|
|
# 32+ random bytes: `openssl rand -hex 32`
|
|
JWT_SECRET=change-me
|
|
# the API refuses to start with a placeholder/short secret unless ALLOW_DEV_SECRET=1 (dev only)
|
|
ACCESS_TOKEN_TTL_SECONDS=3600
|
|
REFRESH_TOKEN_TTL_SECONDS=2592000
|
|
|
|
# --- web ---
|
|
DOMAIN=fin.example.com
|
|
# comma-separated; leave empty when the Flutter web build is served by Caddy from the same origin
|
|
CORS_ORIGINS=
|
|
# dev only: serve a Flutter web build from the API process (prod uses Caddy)
|
|
WEB_DIR=
|
|
|
|
# --- sources (filled in later phases) ---
|
|
ZENMONEY_TOKEN=
|
|
TINVEST_TOKEN=
|