58 lines
2.1 KiB
Bash
58 lines
2.1 KiB
Bash
# Server Configuration
|
|
API_PORT=8080
|
|
ENVIRONMENT=development # IMPORTANT: Change to 'production' for production deployments!
|
|
|
|
# Security - REQUIRED
|
|
API_KEY=CHANGE-THIS-USE-32-CHARS-MINIMUM!!
|
|
|
|
# IP Whitelist (Optional but RECOMMENDED for production)
|
|
# Comma-separated list of allowed IPs or CIDR ranges
|
|
# Leave empty to allow all IPs (NOT recommended for production)
|
|
# Examples:
|
|
# Single IP: ALLOWED_IPS=203.0.113.50
|
|
# Multiple IPs: ALLOWED_IPS=203.0.113.50,198.51.100.25
|
|
# CIDR range: ALLOWED_IPS=192.168.1.0/24
|
|
# Mix: ALLOWED_IPS=203.0.113.50,192.168.1.0/24,10.0.0.0/8
|
|
ALLOWED_IPS=
|
|
|
|
# Enable GitHub Actions IP ranges (automatically whitelists GitHub's IPs)
|
|
# Set to 'true' to allow GitHub Actions to access your API
|
|
# Updates every 24 hours automatically
|
|
ENABLE_GITHUB_IP_RANGES=false
|
|
|
|
# Trusted Proxy Configuration
|
|
# Specify the IP of your reverse proxy (Nginx Proxy Manager, Traefik, etc.)
|
|
# Default: only localhost (127.0.0.1, ::1)
|
|
# Note: The actual client IP is extracted from X-Forwarded-For header
|
|
# Examples:
|
|
# Docker networks: TRUSTED_PROXY_IP=172.16.0.0/12
|
|
# Single proxy: TRUSTED_PROXY_IP=172.18.0.5
|
|
# Multiple proxies: TRUSTED_PROXY_IP=172.18.0.5,192.168.1.10
|
|
TRUSTED_PROXY_IP=
|
|
|
|
# CORS Configuration
|
|
# IMPORTANT: Update this for production deployments
|
|
CORS_ALLOWED_ORIGINS=http://localhost:3000
|
|
|
|
# Vaultwarden Configuration - REQUIRED
|
|
# URL of your Vaultwarden instance (no trailing slash)
|
|
VAULTWARDEN_URL=https://vault.yourdomain.com
|
|
|
|
# Authentication - Choose ONE method:
|
|
# Method 1: API Key (Recommended - bypasses 2FA, auto-login on startup)
|
|
# Get your API key from: Account Settings -> Security -> Keys -> View API Key
|
|
VAULTWARDEN_CLIENT_ID=user.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
|
|
VAULTWARDEN_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxx
|
|
VAULTWARDEN_PASSWORD=your-master-password
|
|
|
|
# Method 2: Pre-generated session token (Alternative - will expire)
|
|
# VAULTWARDEN_ACCESS_TOKEN=your-session-token-here
|
|
|
|
# Performance & Caching
|
|
# How long to cache secrets in memory (reduces API calls)
|
|
# Set to 0 to disable caching (more secure but slower)
|
|
CACHE_TTL=5m
|
|
|
|
# Timeouts
|
|
READ_TIMEOUT=10s
|
|
WRITE_TIMEOUT=10s |