b9dfb86260
Security hardening release addressing CodeQL and Dependabot alerts: - Fix stack trace exposure in error responses - Add SSRF protection with DNS resolution checking - Implement proper URL hostname validation (replaces substring matching) - Add centralized path sanitization to prevent path traversal - Fix ReDoS vulnerability in email validation regex - Improve HTML sanitization in validation utilities - Fix capability wildcard matching in auth utilities - Update glob dependency to address CVE - Add CodeQL suppression comments for verified false positives 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
46 lines
1.2 KiB
Plaintext
46 lines
1.2 KiB
Plaintext
# GT AI OS Environment Configuration Template
|
|
# Copy to .env - secrets are auto-generated on install if empty
|
|
|
|
# === SECURITY CONFIGURATION (Auto-generated if empty) ===
|
|
JWT_SECRET=
|
|
CONTROL_PANEL_JWT_SECRET=
|
|
RESOURCE_CLUSTER_SECRET_KEY=
|
|
|
|
# === ENVIRONMENT SETTINGS ===
|
|
ENVIRONMENT=production
|
|
DEBUG=false
|
|
LOG_LEVEL=INFO
|
|
|
|
# === DATABASE PASSWORDS (Auto-generated if empty) ===
|
|
ADMIN_POSTGRES_PASSWORD=
|
|
TENANT_POSTGRES_PASSWORD=
|
|
TENANT_USER_PASSWORD=
|
|
TENANT_REPLICATOR_PASSWORD=
|
|
RABBITMQ_PASSWORD=
|
|
|
|
# === CORS CONFIGURATION ===
|
|
CORS_ORIGINS=http://localhost:3000,http://localhost:8001,http://localhost:8002,http://localhost:8003
|
|
|
|
# === TENANT CONFIGURATION ===
|
|
TENANT_ID=test
|
|
TENANT_DOMAIN=test-company
|
|
|
|
# === API KEY ENCRYPTION (Auto-generated if empty) ===
|
|
API_KEY_ENCRYPTION_KEY=
|
|
|
|
# === TWO-FACTOR AUTHENTICATION (Auto-generated if empty) ===
|
|
TFA_ENCRYPTION_KEY=
|
|
TFA_ISSUER_NAME=GT Edge AI
|
|
TFA_TEMP_TOKEN_EXPIRY_MINUTES=5
|
|
TFA_RATE_LIMIT_ATTEMPTS=5
|
|
TFA_RATE_LIMIT_WINDOW_MINUTES=1
|
|
|
|
# === SMTP (Enterprise Only - Password Reset) ===
|
|
# SMTP_HOST=smtp-relay.brevo.com
|
|
# SMTP_PORT=587
|
|
# SMTP_USERNAME=
|
|
# SMTP_PASSWORD=
|
|
# SMTP_FROM_EMAIL=
|
|
# SMTP_FROM_NAME=GT AI OS
|
|
# SMTP_USE_TLS=true
|