Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 37 additions & 3 deletions .env.example
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,37 @@ CACHE_MAX_MEMORY_PCT=70
# When enabled, users see a password overlay on first visit
# ADMIN_TOKEN=your-admin-token

# === OAuth/OIDC Configuration (optional) ===
# Set DISABLE_AUTH=true to skip all authentication (open access)
DISABLE_AUTH=false

# GitHub OAuth
# GITHUB_ENABLED=true
# GITHUB_CLIENT_ID=your_github_client_id
# GITHUB_CLIENT_SECRET=your_github_client_secret
# GITHUB_CALLBACK_URL=https://yourdomain.com/auth/github/callback
# GITHUB_ALLOWED_USERNAMES=user1,user2
# ALLOWED_ADMINS=admin1,admin2

# OIDC Providers (comma-separated names, e.g., "authentik,pocketid")
# OIDC_PROVIDERS=authentik,pocketid

# Authentik OIDC
# OIDC_AUTHENTIK_CLIENT_ID=your_client_id
# OIDC_AUTHENTIK_CLIENT_SECRET=your_client_secret
# OIDC_AUTHENTIK_DISCOVER_URL=https://auth.yourdomain.com/application/o/provider/.well-known/openid-configuration
# OIDC_AUTHENTIK_DISPLAY_NAME=Authentik
# OIDC_AUTHENTIK_ALLOWED_USERS=user1,user2
# OIDC_AUTHENTIK_ALLOWED_ADMINS=admin1

# PocketID OIDC
# OIDC_POCKETID_CLIENT_ID=your_client_id
# OIDC_POCKETID_CLIENT_SECRET=your_client_secret
# OIDC_POCKETID_DISCOVER_URL=https://pocketid.yourdomain.com/.well-known/openid-configuration
# OIDC_POCKETID_DISPLAY_NAME=PocketID
# OIDC_POCKETID_ALLOWED_USERS=user1,user2
# OIDC_POCKETID_ALLOWED_ADMINS=admin1

# === TLS/HTTPS Configuration (optional) ===
TLS_ENABLED=false
CERT_DIR=./certs
Expand All @@ -67,9 +98,12 @@ CERT_CHECK_HOURS=12
# IP_CERT_RENEWAL_HOURS=96

# === Security ===
# Allow all response headers including dangerous ones like Service-Worker-Allowed
# Default: false (blocked on main domain path-based routing /r/)
ALLOW_ALL_HEADERS=false
# Serve user-controlled content at /r/<subdomain> on the dashboard origin.
# This is useful for domainless/IP deployments, but weakens origin isolation.
DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT=false
# Allow origin-scoped headers such as Service-Worker-Allowed and Alt-Svc on /r/ routes.
# Has no effect unless same-origin user content is enabled above.
DANGEROUSLY_ALLOW_ALL_HEADERS=false

# === Error Tracking (Sentry) ===
# SENTRY_DSN_BACKEND=https://xxx@sentry.io/xxx
Expand Down
4 changes: 4 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -294,3 +294,7 @@ backend/ip2country
dns/ip2country

pyrightconfig.json


.DS_Store
**/.DS_Store
Loading