source: Klonkt/.env.example@ 28d152e

main
Last change on this file since 28d152e was 9e27d64, checked in by roboburr <roboburr@…>, 3 months ago

auth: password admin + per-instance Google for listeners (no broker)

Robin's choice: every self-hoster has their own password admin account,
and can optionally let listeners log in to comment using their OWN Google
client. No central broker (that would tie every customer site to Robin's
Google Cloud -> systemic risk on abuse).

  • Admin = username/password (bcrypt). First-time setup via /auth/register (only when there are 0 users); closed afterwards. No public registration.
  • Forgot password: /auth/reset-request -> email (if SMTP configured) with reset link; CLI break-glass npm run reset-admin always works (no email needed).
  • Change password (logged in) restored in /account.
  • Google = per-instance own credentials, OPTIONAL, listeners only -> always role member, never admin (god/admin email is rejected; google_sub mismatch too).
  • config/google.js back to direct Google OAuth; config/mailer.js new (nodemailer).
  • jose removed from deps; nodemailer added.

Security review (workflow) incorporated:

  • Reset token no longer in production logs (dev only).
  • Reset link from PUBLIC_BASE_URL instead of X-Forwarded-Host (host poisoning).
  • Reset tokens stored SHA-256-hashed in the DB.
  • Same-origin check on all state-modifying POSTs (CSRF layer on top of sameSite-lax).
  • Login always runs one bcrypt comparison (no timing enumeration).

Co-Authored-By: Claude <noreply@…>
  • Property mode set to 100644
File size: 1.8 KB
Line 
1NODE_ENV=development
2PORT=3000
3SESSION_SECRET=change-me-to-a-strong-random-string-min-32-chars
4DATABASE_PATH=./storage/database.sqlite
5MEDIA_PATH=./storage/media
6
7# Canonieke publieke URL van deze site (scheme + host, geen pad/slash). Gebruikt
8# voor links in e-mails (wachtwoord-reset) i.p.v. request-headers — voorkomt
9# host-header-spoofing. Niet gezet? Dan valt het terug op de request-host (dev).
10PUBLIC_BASE_URL=https://example.com
11
12# ── Beheerder ───────────────────────────────────────────────────────
13# De beheerder logt in met gebruikersnaam + wachtwoord. Bij de eerste keer
14# opstarten maak je via /auth/register je beheerdersaccount aan; daarna is
15# registratie gesloten. Wachtwoord vergeten? -> "Wachtwoord vergeten" (mail,
16# zie SMTP hieronder) of altijd: `npm run reset-admin` op de server.
17
18# ── Google login voor LUISTERAARS (optioneel) ───────────────────────
19# Wil je dat luisteraars met Google kunnen inloggen om te reageren? Maak dan
20# een EIGEN Google OAuth-client aan (Google Cloud Console -> Credentials ->
21# OAuth client ID -> "Web application") en vul hieronder in. Eigen client =
22# eigen Google Cloud project; deze site hangt nergens centraal aan vast.
23# Niet ingesteld? Dan is er simpelweg geen Google-knop. Google-login geeft
24# NOOIT beheerrechten (alleen reageren).
25# GOOGLE_REDIRECT_URI = <jouw domein>/auth/google/callback (exact in de client zetten)
26GOOGLE_CLIENT_ID=
27GOOGLE_CLIENT_SECRET=
28GOOGLE_REDIRECT_URI=https://example.com/auth/google/callback
29
30# ── E-mail (optioneel) — voor "wachtwoord vergeten" reset-links ─────
31# Niet ingesteld? Dan werkt reset alleen via `npm run reset-admin` op de server.
32SMTP_HOST=
33SMTP_PORT=587
34SMTP_USER=
35SMTP_PASS=
36SMTP_FROM=
Note: See TracBrowser for help on using the repository browser.