24282d1279
Adds defence-in-depth shared-secret auth that activates when API_KEY is set. Behaviour: - empty API_KEY (dev default): every request allowed, middleware is not even installed; - non-empty API_KEY: every request under APP_API_PREFIX except /health must carry X-API-Key: <value> or Authorization: Bearer <value>. /, /docs, /redoc, /openapi.json and CORS preflight stay open. hmac.compare_digest is used for the constant-time comparison. The middleware resolves settings lazily so test fixtures can reload app.config and have the new API_KEY take effect on the next install. Tests (tests/test_api_security.py, 5 cases): - /health remains open; - protected route rejects missing key (401); - protected route accepts X-API-Key header; - protected route accepts Authorization: Bearer header; - protected route rejects a wrong key. Frontend: - VITE_API_KEY env reads the key and Axios injects it on every request, falling back to no header when empty so SSO/reverse-proxy deployments stay unchanged. - vite-env.d.ts adds the new env entry. Docs/ops: - .env.example documents the dev-default empty key; - .env.prod.example marks API_KEY as a required rotation point; - docker-compose.yml forwards API_KEY (defaults to empty); - docker-compose.prod.yml fails the stack with ?:required when API_KEY is missing; - RUNBOOK gains an API authentication section with header examples and the reverse-proxy + key layering recommendation. pytest -q: 33 passed (5 new security + 28 prior). npx tsc --noEmit: clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
88 lines
2.1 KiB
Plaintext
88 lines
2.1 KiB
Plaintext
# ---- DEVELOPMENT TEMPLATE ----
|
|
# Copy to .env. Values below are intentionally weak defaults for local Docker
|
|
# Compose. NEVER use them in production — see .env.prod.example.
|
|
|
|
# ==== PostgreSQL ====
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=legacyhub
|
|
POSTGRES_USER=legacyhub
|
|
POSTGRES_PASSWORD=legacyhub
|
|
|
|
# ==== MinIO ====
|
|
MINIO_ENDPOINT=minio:9000
|
|
MINIO_ACCESS_KEY=legacyhub
|
|
MINIO_SECRET_KEY=legacyhub-secret
|
|
MINIO_BUCKET_ORIGINALS=legacyhub-originals
|
|
MINIO_BUCKET_DERIVED=legacyhub-derived
|
|
MINIO_SECURE=false
|
|
MINIO_REGION=us-east-1
|
|
|
|
# ==== OpenSearch ====
|
|
OPENSEARCH_HOST=opensearch
|
|
OPENSEARCH_PORT=9200
|
|
OPENSEARCH_USE_SSL=false
|
|
OPENSEARCH_VERIFY_CERTS=false
|
|
OPENSEARCH_USER=
|
|
OPENSEARCH_PASSWORD=
|
|
OPENSEARCH_INDEX_CHUNKS=legacy_chunks
|
|
|
|
# ==== Qdrant ====
|
|
QDRANT_HOST=qdrant
|
|
QDRANT_PORT=6333
|
|
QDRANT_API_KEY=
|
|
QDRANT_COLLECTION_CHUNKS=legacy_chunks
|
|
|
|
# ==== Redis ====
|
|
REDIS_URL=redis://redis:6379/0
|
|
|
|
# ==== OCR ====
|
|
OCR_LANGUAGES=rus+eng
|
|
OCR_ENABLED=true
|
|
DOCLING_OCR_ENABLED=false
|
|
MAX_DOCUMENT_TIMEOUT_SECONDS=180
|
|
OCR_DESKEW=true
|
|
OCR_CLEAN=true
|
|
OCR_OPTIMIZE=1
|
|
|
|
# ==== Embeddings / Reranker ====
|
|
EMBEDDING_MODEL=BAAI/bge-m3
|
|
EMBEDDING_DIM=1024
|
|
EMBEDDING_DEVICE=cpu
|
|
EMBEDDING_BATCH_SIZE=8
|
|
EMBEDDING_NORMALIZE=true
|
|
|
|
RERANKER_MODEL=BAAI/bge-reranker-v2-m3
|
|
RERANKER_DEVICE=cpu
|
|
RERANKER_ENABLED=true
|
|
RERANKER_BATCH_SIZE=8
|
|
|
|
# ==== Chunking ====
|
|
CHUNK_TARGET_TOKENS=700
|
|
CHUNK_MIN_TOKENS=120
|
|
CHUNK_MAX_TOKENS=900
|
|
CHUNK_OVERLAP_TOKENS=100
|
|
|
|
# ==== Search ====
|
|
HYBRID_OPENSEARCH_TOP_K=50
|
|
HYBRID_QDRANT_TOP_K=50
|
|
HYBRID_RRF_K=60
|
|
RERANK_CANDIDATES=40
|
|
|
|
# ==== App ====
|
|
APP_LOG_LEVEL=INFO
|
|
APP_HOST=0.0.0.0
|
|
APP_PORT=8000
|
|
APP_INPUT_DIR=/data/input
|
|
APP_WORK_DIR=/data/work
|
|
APP_API_PREFIX=/api/v1
|
|
|
|
# Comma-separated list of allowed origins for the browser. Use specific origins
|
|
# in production; * is accepted only for local development.
|
|
CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5273,http://localhost:4173
|
|
|
|
# Optional shared-secret API key. When empty, the API is open (dev default).
|
|
# When set, every request under APP_API_PREFIX except /health requires
|
|
# X-API-Key: <value> or Authorization: Bearer <value>.
|
|
API_KEY=
|