91ff467f2f
Critical fixes: - init_admin.py: replace hardcoded admin123 password with ADMIN_PASSWORD env var - proxmox_client.py, models.py: change verify_ssl default from False to True - api/proxmox.py: use server.verify_ssl instead of hardcoded verify=False in websocket handler - ssh_client.py: replace AutoAddPolicy (MITM-vulnerable) with WarningPolicy + load_system_host_keys Security hardening: - main.py: add security headers middleware (CSP, X-Frame-Options, HSTS, X-XSS-Protection, Referrer-Policy) - main.py: fix CORS — allow_credentials=True is incompatible with allow_origins=["*"]; read origins from CORS_ORIGINS env var - auth.py, logging_middleware.py: validate X-Forwarded-For/X-Real-IP to prevent IP spoofing Performance: - monitoring_worker.py: wire up cleanup_expired_connections() as hourly scheduled job (was defined but never called) Code quality: - logging_service.py: move `import json` from inside function to module level - ssh_client.py, proxmox_client.py, api/proxmox.py, rbac/migration.py, task_queue_service.py: replace all bare `except:` with `except Exception:` - .env.example, config.py: document ADMIN_PASSWORD and CORS_ORIGINS settings https://claude.ai/code/session_019rK2wvaWg5zXFwmAPPEB7R
41 lines
1.1 KiB
Plaintext
41 lines
1.1 KiB
Plaintext
# ============================================
|
|
# Server Panel Backend Configuration
|
|
# ============================================
|
|
|
|
# Application
|
|
PANEL_NAME=Server Panel
|
|
DEBUG=false
|
|
LOG_LEVEL=INFO
|
|
|
|
# Database (matches docker-compose)
|
|
DB_HOST=db
|
|
DB_PORT=5432
|
|
DB_USER=serverpanel
|
|
DB_PASSWORD=serverpanel_secure_password
|
|
DB_NAME=serverpanel
|
|
DATABASE_URL=postgresql://serverpanel:serverpanel_secure_password@db:5432/serverpanel
|
|
|
|
# JWT Authentication
|
|
SECRET_KEY=your-very-secure-secret-key-change-this-in-production-minimum-32-chars
|
|
ALGORITHM=HS256
|
|
ACCESS_TOKEN_EXPIRE_MINUTES=1440
|
|
|
|
# SSH Configuration
|
|
SSH_TIMEOUT=10
|
|
DEFAULT_SSH_USER=root
|
|
DEFAULT_SSH_PORT=22
|
|
|
|
# Security
|
|
# In production set to your actual domain(s), e.g.: https://panel.example.com
|
|
CORS_ORIGINS=*
|
|
ALLOWED_HOSTS=localhost,127.0.0.1
|
|
# IMPORTANT: Change this before first deployment!
|
|
ADMIN_PASSWORD=admin123
|
|
|
|
# Update Check Configuration
|
|
# Note: DISABLE_UPDATE_CHECK and GITHUB_TOKEN are managed via root .env
|
|
# (see ../.env.example) and passed in docker-compose. Uncomment below only
|
|
# if running backend standalone without compose.
|
|
# DISABLE_UPDATE_CHECK=false
|
|
# GITHUB_TOKEN=
|