bonaminandClaude Opus 5.5
81365eed89
The shared legacy password is still needed for boards on pre-HMAC firmware, but it was accepted for any username. Now: - controlled by MQTT_ALLOW_LEGACY_PASSWORD (config.py, default true; documented in .env.example) so it can be switched off without a deploy, - only accepted for device-shaped usernames (uppercase alphanumeric segments joined by "-", optional "-kiosk"), never for app_ users or any other shape, - every successful legacy login is logged at WARNING with the username, rate-limited to once per username per hour, so the boards still depending on it are visible before the flag is turned off. HMAC auth is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
42 lines
1.3 KiB
Bash
42 lines
1.3 KiB
Bash
# Firebase
|
|
FIREBASE_SERVICE_ACCOUNT_PATH=./firebase-service-account.json
|
|
FIREBASE_STORAGE_BUCKET=your-project-id.appspot.com
|
|
|
|
# JWT
|
|
JWT_SECRET_KEY=your-secret-key-here
|
|
JWT_ALGORITHM=HS256
|
|
JWT_EXPIRATION_MINUTES=480
|
|
|
|
# MQTT
|
|
MQTT_BROKER_HOST=localhost
|
|
MQTT_BROKER_PORT=1883
|
|
MQTT_ADMIN_USERNAME=admin
|
|
MQTT_ADMIN_PASSWORD=your-mqtt-admin-password
|
|
MOSQUITTO_PASSWORD_FILE=/etc/mosquitto/passwd
|
|
# Must be unique per running instance (VPS vs local dev)
|
|
MQTT_CLIENT_ID=bellsystems-admin-panel
|
|
# HMAC secret used to derive per-device MQTT passwords (must match firmware)
|
|
MQTT_SECRET=change-me-in-production
|
|
# Accept the legacy shared "vesper" MQTT password for device usernames
|
|
# (old firmware). Each use is logged once/hour per board; set to false
|
|
# once no boards show up in those logs.
|
|
MQTT_ALLOW_LEGACY_PASSWORD=true
|
|
|
|
# App
|
|
BACKEND_CORS_ORIGINS=["http://localhost:5173"]
|
|
DEBUG=true
|
|
# Port nginx binds on the host (use 90 on VPS if 80 is taken)
|
|
NGINX_PORT=80
|
|
|
|
# Local file storage (override if you want to store data elsewhere)
|
|
SQLITE_DB_PATH=./data/database.db
|
|
BUILT_MELODIES_STORAGE_PATH=./storage/built_melodies
|
|
FIRMWARE_STORAGE_PATH=./storage/firmware
|
|
|
|
# Nextcloud WebDAV
|
|
NEXTCLOUD_URL=https://cloud.example.com
|
|
NEXTCLOUD_USERNAME=service-account@example.com
|
|
NEXTCLOUD_PASSWORD=your-password-here
|
|
NEXTCLOUD_DAV_USER=admin
|
|
NEXTCLOUD_BASE_PATH=BellSystems/Console
|