gtiandClaude Opus 5.5
91a2dda969
GTI terminates TLS in its Nginx Proxy Manager (10.0.10.100), not on the Hub host, so the Hub must be reachable on the LAN — by the proxy only. - docker-compose.prod.yml passes FORWARDED_ALLOW_IPS (uvicorn then trusts X-Forwarded-For/-Proto from the proxy only: real client IPs in audit and session records, https scheme) and WEB_COOKIE_SECURE. Defaults keep the previous behaviour. - restrict_hub_port.sh + gti-fiscal-hub-port.service: Docker-published ports bypass UFW, so the source restriction lives in DOCKER-USER, matched on the conntrack original destination with --ctdir ORIGINAL, and is re-applied whenever docker.service starts (the chain is not persisted across reboots). - *.service forced to LF like *.sh; tests cover both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
25 lines
1010 B
Bash
25 lines
1010 B
Bash
# GTI Fiscal Hub — production environment (copy to .env, never commit .env)
|
|
GTI_FISCAL_VERSION=1.0.0-rc1
|
|
|
|
# REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
|
|
POSTGRES_PASSWORD=
|
|
|
|
# REQUIRED. Public HTTPS URL that Agents use (TLS terminates in the reverse proxy in front of the Hub).
|
|
BASE_URL=https://fiscal.example.gti
|
|
|
|
# Interface the Hub listens on. Keep 127.0.0.1 when a reverse proxy runs on the same host; use the LAN IP only behind a firewall.
|
|
# Docker-published ports bypass UFW: restrict the source in the DOCKER-USER chain (see docs/PILOT_DEPLOYMENT.md).
|
|
HUB_BIND=127.0.0.1
|
|
HUB_PORT=8000
|
|
|
|
# IP(s) of the reverse proxy allowed to set X-Forwarded-For/-Proto (comma-separated). 127.0.0.1 = same host.
|
|
FORWARDED_ALLOW_IPS=127.0.0.1
|
|
# 1 once HTTPS terminates in front of the Hub (session/CSRF cookies become Secure).
|
|
WEB_COOKIE_SECURE=0
|
|
|
|
LOG_LEVEL=INFO
|
|
AGENT_ONLINE_THRESHOLD_SECONDS=120
|
|
|
|
# Directory (host) where pg_dump backups are written by backup.sh
|
|
BACKUP_DIR=./backups
|