5f688abff3
Encrypt Proxmox server passwords and VM cloud-init passwords in the database: - Add backend/app/crypto.py: Fernet-based encrypt/decrypt helpers + EncryptedString SQLAlchemy TypeDecorator (transparent to all existing code, no API changes) - Add FERNET_KEY config field (env var); without it values stay plaintext for backward compatibility, with a logged warning - Update models.py: ProxmoxServer.password and VMInstance.cloud_init_password now use EncryptedString(255) instead of String(255) - Add migration 14 in migrations/migrations.py: idempotent re-encryption of existing plaintext rows (skipped when FERNET_KEY is not set) CSRF analysis: - /api/auth/change-password is protected by JWT Bearer token (Authorization header) - Browsers cannot auto-include Authorization headers cross-site → CSRF is not applicable here; added explanatory comment Improve migration loading: - Add migrations/__init__.py to make it a proper Python package - Replace fragile importlib dynamic loading in main.py with a standard import https://claude.ai/code/session_019rK2wvaWg5zXFwmAPPEB7R
47 lines
1.5 KiB
Plaintext
47 lines
1.5 KiB
Plaintext
# ============================================
|
|
# Server Panel Backend Configuration
|
|
# ============================================
|
|
|
|
# Application
|
|
PANEL_NAME=Server Panel
|
|
DEBUG=false
|
|
LOG_LEVEL=INFO
|
|
|
|
# Database (matches docker-compose)
|
|
DB_HOST=db
|
|
DB_PORT=5432
|
|
DB_USER=serverpanel
|
|
DB_PASSWORD=serverpanel_secure_password
|
|
DB_NAME=serverpanel
|
|
DATABASE_URL=postgresql://serverpanel:serverpanel_secure_password@db:5432/serverpanel
|
|
|
|
# JWT Authentication
|
|
SECRET_KEY=your-very-secure-secret-key-change-this-in-production-minimum-32-chars
|
|
ALGORITHM=HS256
|
|
ACCESS_TOKEN_EXPIRE_MINUTES=1440
|
|
|
|
# SSH Configuration
|
|
SSH_TIMEOUT=10
|
|
DEFAULT_SSH_USER=root
|
|
DEFAULT_SSH_PORT=22
|
|
|
|
# Security
|
|
# In production set to your actual domain(s), e.g.: https://panel.example.com
|
|
CORS_ORIGINS=*
|
|
ALLOWED_HOSTS=localhost,127.0.0.1
|
|
# IMPORTANT: Change this before first deployment!
|
|
ADMIN_PASSWORD=admin123
|
|
|
|
# Fernet encryption key for sensitive DB fields (Proxmox passwords, cloud-init passwords).
|
|
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
# WARNING: Keep this key safe — losing it means losing access to encrypted passwords.
|
|
# If not set, passwords are stored as plaintext (insecure).
|
|
FERNET_KEY=
|
|
|
|
# Update Check Configuration
|
|
# Note: DISABLE_UPDATE_CHECK and GITHUB_TOKEN are managed via root .env
|
|
# (see ../.env.example) and passed in docker-compose. Uncomment below only
|
|
# if running backend standalone without compose.
|
|
# DISABLE_UPDATE_CHECK=false
|
|
# GITHUB_TOKEN=
|