gtiandClaude Opus 5.5
64d3fc56e2
Collaborators logged into GTI Gerenciador open GTI Fiscal without a second password. The panel signs a 60 s JWT (Ed25519; the Hub holds only the public key); the Hub checks signature, iss/aud/exp/nbf, maximum lifetime, nonce against a one-time state cookie set when the flow starts at GET /login (login-CSRF protection) and a single-use jti (sso_used_assertions). Collaborators are provisioned in admin_users with auth_source=GTI_GERENCIADOR and no password; a CHECK constraint makes a passwordless local account or a federated account with a password impossible (migration 0021). Sessions last FEDERATED_SESSION_SECONDS (1 h) and are renewed silently through the panel. The local admin stays as break-glass at /login/local, audited. Logout ends only the Hub session. Every SSO success/rejection (stable reason code), logout and local login is audited with the real client IP, never the token. verify_password now fails closed on a missing hash instead of raising. Visual identity: gti-theme.css is a verbatim copy of the panel's design system (tokens, sidebar, light/dark theme) plus its tema.js, sidebar.js and logo; control-panel.css keeps only Hub components, all colours from the panel tokens. Page structure and features unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
32 lines
1.4 KiB
Bash
32 lines
1.4 KiB
Bash
# GTI Fiscal Hub — production environment (copy to .env, never commit .env)
|
|
GTI_FISCAL_VERSION=1.0.0-rc1
|
|
|
|
# REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
|
|
POSTGRES_PASSWORD=
|
|
|
|
# REQUIRED. Public HTTPS URL that Agents use (TLS terminates in the reverse proxy in front of the Hub).
|
|
BASE_URL=https://fiscal.example.gti
|
|
|
|
# Interface the Hub listens on. Keep 127.0.0.1 when a reverse proxy runs on the same host; use the LAN IP only behind a firewall.
|
|
# Docker-published ports bypass UFW: restrict the source in the DOCKER-USER chain (see docs/PILOT_DEPLOYMENT.md).
|
|
HUB_BIND=127.0.0.1
|
|
HUB_PORT=8000
|
|
|
|
# IP(s) of the reverse proxy allowed to set X-Forwarded-For/-Proto (comma-separated). 127.0.0.1 = same host.
|
|
FORWARDED_ALLOW_IPS=127.0.0.1
|
|
# 1 once HTTPS terminates in front of the Hub (session/CSRF cookies become Secure).
|
|
WEB_COOKIE_SECURE=0
|
|
|
|
# SSO from GTI Gerenciador (docs/PILOT_DEPLOYMENT.md, "Human access"). Needs HTTPS (WEB_COOKIE_SECURE=1).
|
|
# PUBLIC key only (raw Ed25519, base64url) — the private key lives only in the panel.
|
|
SSO_GERENCIADOR_CHAVE_PUBLICA=
|
|
SSO_START_URL=https://gtigerenciador.example.gti/sso/fiscal
|
|
# Collaborator session lifetime; afterwards they are signed in again transparently.
|
|
FEDERATED_SESSION_SECONDS=3600
|
|
|
|
LOG_LEVEL=INFO
|
|
AGENT_ONLINE_THRESHOLD_SECONDS=120
|
|
|
|
# Directory (host) where pg_dump backups are written by backup.sh
|
|
BACKUP_DIR=./backups
|