24282d1279
Adds defence-in-depth shared-secret auth that activates when API_KEY is set. Behaviour: - empty API_KEY (dev default): every request allowed, middleware is not even installed; - non-empty API_KEY: every request under APP_API_PREFIX except /health must carry X-API-Key: <value> or Authorization: Bearer <value>. /, /docs, /redoc, /openapi.json and CORS preflight stay open. hmac.compare_digest is used for the constant-time comparison. The middleware resolves settings lazily so test fixtures can reload app.config and have the new API_KEY take effect on the next install. Tests (tests/test_api_security.py, 5 cases): - /health remains open; - protected route rejects missing key (401); - protected route accepts X-API-Key header; - protected route accepts Authorization: Bearer header; - protected route rejects a wrong key. Frontend: - VITE_API_KEY env reads the key and Axios injects it on every request, falling back to no header when empty so SSO/reverse-proxy deployments stay unchanged. - vite-env.d.ts adds the new env entry. Docs/ops: - .env.example documents the dev-default empty key; - .env.prod.example marks API_KEY as a required rotation point; - docker-compose.yml forwards API_KEY (defaults to empty); - docker-compose.prod.yml fails the stack with ?:required when API_KEY is missing; - RUNBOOK gains an API authentication section with header examples and the reverse-proxy + key layering recommendation. pytest -q: 33 passed (5 new security + 28 prior). npx tsc --noEmit: clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
78 lines
1.9 KiB
Plaintext
78 lines
1.9 KiB
Plaintext
# ---- PRODUCTION TEMPLATE ----
|
|
# Copy to .env.prod and replace every PLACEHOLDER value.
|
|
# Never commit .env.prod.
|
|
# All values below are placeholders — rotation required before use.
|
|
|
|
# ==== PostgreSQL ====
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
POSTGRES_DB=legacyhub
|
|
POSTGRES_USER=legacyhub_prod
|
|
POSTGRES_PASSWORD=__ROTATE_ME__
|
|
|
|
# ==== MinIO ====
|
|
MINIO_ENDPOINT=minio:9000
|
|
MINIO_ACCESS_KEY=__ROTATE_ME__
|
|
MINIO_SECRET_KEY=__ROTATE_ME__
|
|
MINIO_BUCKET_ORIGINALS=legacyhub-originals
|
|
MINIO_BUCKET_DERIVED=legacyhub-derived
|
|
MINIO_SECURE=true
|
|
MINIO_REGION=us-east-1
|
|
|
|
# ==== OpenSearch (security plugin ON in prod overlay) ====
|
|
OPENSEARCH_HOST=opensearch
|
|
OPENSEARCH_PORT=9200
|
|
OPENSEARCH_USE_SSL=true
|
|
OPENSEARCH_VERIFY_CERTS=true
|
|
OPENSEARCH_USER=admin
|
|
OPENSEARCH_PASSWORD=__ROTATE_ME__
|
|
OPENSEARCH_INDEX_CHUNKS=legacy_chunks
|
|
OPENSEARCH_ADMIN_PASSWORD=__ROTATE_ME__
|
|
|
|
# ==== Qdrant ====
|
|
QDRANT_HOST=qdrant
|
|
QDRANT_PORT=6333
|
|
QDRANT_API_KEY=__ROTATE_ME__
|
|
QDRANT_COLLECTION_CHUNKS=legacy_chunks
|
|
|
|
# ==== Redis ====
|
|
REDIS_URL=redis://:__ROTATE_ME__@redis:6379/0
|
|
|
|
# ==== OCR ====
|
|
OCR_LANGUAGES=rus+eng
|
|
OCR_ENABLED=true
|
|
DOCLING_OCR_ENABLED=false
|
|
MAX_DOCUMENT_TIMEOUT_SECONDS=300
|
|
|
|
# ==== Embeddings / Reranker ====
|
|
EMBEDDING_MODEL=BAAI/bge-m3
|
|
EMBEDDING_DIM=1024
|
|
EMBEDDING_DEVICE=cuda
|
|
EMBEDDING_BATCH_SIZE=32
|
|
EMBEDDING_NORMALIZE=true
|
|
|
|
RERANKER_MODEL=BAAI/bge-reranker-v2-m3
|
|
RERANKER_DEVICE=cuda
|
|
RERANKER_ENABLED=true
|
|
RERANKER_BATCH_SIZE=32
|
|
|
|
# ==== Hybrid search ====
|
|
HYBRID_OPENSEARCH_TOP_K=50
|
|
HYBRID_QDRANT_TOP_K=50
|
|
HYBRID_RRF_K=60
|
|
RERANK_CANDIDATES=40
|
|
|
|
# ==== App ====
|
|
APP_LOG_LEVEL=INFO
|
|
APP_HOST=0.0.0.0
|
|
APP_PORT=8000
|
|
APP_INPUT_DIR=/data/input
|
|
APP_WORK_DIR=/data/work
|
|
APP_API_PREFIX=/api/v1
|
|
|
|
# Comma-separated list of allowed origins. NEVER use * in production.
|
|
CORS_ALLOWED_ORIGINS=https://legacyhub.teamhub.example
|
|
|
|
# Mandatory in production. Use a long random value (e.g. `openssl rand -hex 32`).
|
|
API_KEY=__ROTATE_ME__
|