hobokenchicken
130187c7be
P0 fixes: - WebSocket origin checking (reject untrusted origins) - WS session token moved from URL query param to first message frame - WebAuthn login cookie now uses Secure flag via shared SetSessionCookie - PostgreSQL sslmode configurable via POSTGRES_SSLMODE env (default: require) - Fixed DatabaseDSN to use real password instead of masked placeholder P1 fixes: - Per-IP rate limiting middleware (auth: 5 req/s, invites: 2 req/s) - Security headers on all responses (CSP, X-Frame-Options, nosniff, etc.) - WS broadcasts scoped to server members (prevents cross-server data leak) - Webhook tokens stored as SHA-256 hashes (not plaintext) P2 fixes: - CSRF protection via Origin header validation on state-changing requests - MANAGE_CHANNELS permission enforced on channel update/delete - Upload validation: 25MB limit, extension allowlist, server-side MIME check - File serve: path traversal protection + Content-Disposition: attachment Files: 23 changed, +499/-100. Builds clean (go build, go vet, npm build). Zero CVEs (govulncheck, npm audit).
26 lines
609 B
Bash
26 lines
609 B
Bash
# App
|
|
DUMPSTER_HOST=localhost
|
|
DUMPSTER_PORT=8080
|
|
DUMPSTER_SECRET=*** Database
|
|
POSTGRES_HOST=localhost
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_USER=dumpster
|
|
POSTGRES_PASSWORD=dumpster
|
|
POSTGRES_SSLMODE=disable
|
|
# Valkey
|
|
VALKEY_URL=redis://localhost:***@example.com
|
|
# MinIO
|
|
MINIO_ENDPOINT=minio:9000
|
|
MINIO_ACCESS_KEY=<generated>
|
|
MINIO_SECRET_KEY=<gener...n
|
|
# LiveKit
|
|
LIVEKIT_URL=wss://livekit.your.domain
|
|
LIVEKIT_API_KEY=<generated>
|
|
LIVEKIT_API_SECRET=<gener...n
|
|
# Web Push
|
|
VAPID_PUBLIC_KEY=<generated>
|
|
VAPID_PRIVATE_KEY=<generated>
|
|
VAPID_SUBJECT=mailto:admin@your.domain
|
|
# Integrations
|
|
GIPHY_API_KEY=your_giphy_api_key_here
|