Mercurial

annotate mrjunejune/.config.development @ 264:04fee26ecce0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
add authenticated JRPG conversation platform Add reusable auth/session storage, owned conversation recovery, guest quotas, admin workflows, URL-routed conversation UI, mobile frame support, and parallel browser acceptance. Co-authored-by: Copilot <[email protected]>
author MrJuneJune <me@mrjunejune.com>
date Fri, 07 Aug 2026 07:34:12 -0700
parents 90dfcef375fb
children 056790c4fb0d
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
264
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
1 # MrJuneJune Server Configuration — DEVELOPMENT TEMPLATE
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
2 #
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
3 # This file is a copyable filler only. It contains no real secrets, hashes,
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
4 # or credentials. Copy it to .config (which is VCS-ignored) and fill in your
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
5 # local values before starting the server.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
6 #
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
7 # cp mrjunejune/.config.development mrjunejune/.config
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
8 #
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
9 # ─────────────────────────────────────────────────────────────────────────────
200
90dfcef375fb Added my own s3 bucket uploader url to mrjunejune.
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
10 # Auth token for S3 upload API
264
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
11 # Client must send: Authorization: Bearer <token>
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
12 UPLOAD_AUTH_TOKEN=REPLACE_WITH_LOCAL_TOKEN
200
90dfcef375fb Added my own s3 bucket uploader url to mrjunejune.
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
13
90dfcef375fb Added my own s3 bucket uploader url to mrjunejune.
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
14 # S3 Configuration
264
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
15 S3_REGION=REPLACE_WITH_REGION
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
16 S3_BUCKET=REPLACE_WITH_BUCKET
200
90dfcef375fb Added my own s3 bucket uploader url to mrjunejune.
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
17
90dfcef375fb Added my own s3 bucket uploader url to mrjunejune.
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
18 # Presigned URL expiration (seconds)
264
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
19 S3_URL_EXPIRES=3600
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
20
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
21 # ─────────────────────────────────────────────────────────────────────────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
22 # Auth — all AUTH_* values may also be set as environment variables; env takes
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
23 # precedence over this file. Never commit real values here.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
24 #
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
25 # AUTH_COOKIE_SECRET
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
26 # A cryptographically random 32-byte secret encoded as a lowercase hex string
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
27 # (64 hex chars). Used to sign session and guest cookies via HMAC-SHA-256.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
28 # Generate with:
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
29 # openssl rand -hex 32
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
30 # Minimum: 64 hex chars (32 bytes). Maximum: 2048 hex chars (1024 bytes).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
31 AUTH_COOKIE_SECRET=REPLACE_WITH_OUTPUT_OF_openssl_rand_hex_32
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
32
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
33 # AUTH_BOOTSTRAP_USERNAME / AUTH_BOOTSTRAP_PASSWORD_HASH
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
34 # Creates the initial admin account on first startup if no admin exists yet.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
35 # Both must be set together, or both must be absent.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
36 # Generate the hash with:
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
37 # bazel run //auth:hash_password
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
38 # Then enter the desired bootstrap password at the prompt.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
39 # Example format (do not use this value — it is a public test fixture):
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
40 # zenbu-scrypt$v=1$N=32768$r=8$p=1$<salt>$<hash>
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
41 AUTH_BOOTSTRAP_USERNAME=admin
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
42 AUTH_BOOTSTRAP_PASSWORD_HASH=REPLACE_WITH_OUTPUT_OF_bazel_run_//auth:hash_password
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
43
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
44 # AUTH_TRUSTED_PROXY
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
45 # Exact direct-peer IP address of your reverse proxy (e.g. nginx/Caddy).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
46 # When set, the server trusts X-Real-IP from this peer for client-IP binding.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
47 # Leave commented out if the server receives direct connections.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
48 # Must be a valid IPv4 or IPv6 address.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
49 # AUTH_TRUSTED_PROXY=10.0.0.1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
50
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
51 # AUTH_SESSION_IDLE_TTL / AUTH_SESSION_ABS_TTL
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
52 # Idle TTL: seconds since last request before a session expires (default 7 d).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
53 # Abs TTL: absolute session lifetime regardless of activity (default 30 d).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
54 # Idle must not exceed Abs. Both must be 60–31536000.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
55 # AUTH_SESSION_IDLE_TTL=604800
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
56 # AUTH_SESSION_ABS_TTL=2592000
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
57
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
58 # AUTH_GUEST_TTL
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
59 # Lifetime of a guest identity record in seconds (default 30 d).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
60 # AUTH_GUEST_TTL=2592000
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
61
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
62 # AUTH_DEV_INSECURE_COOKIE
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
63 # Set to true to issue cookies without the Secure attribute.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
64 # ONLY valid when SERVER_HOST is a loopback address (127.0.0.1, ::1, or localhost).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
65 # Must NOT be set in production or on a non-loopback bind.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
66 AUTH_DEV_INSECURE_COOKIE=true
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
67
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
68 # ─────────────────────────────────────────────────────────────────────────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
69 # SERVER_HOST
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
70 # IP address the server listens on. Defaults to 0.0.0.0 (all interfaces).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
71 # For local development, set to 127.0.0.1 — required when
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
72 # AUTH_DEV_INSECURE_COOKIE=true.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
73 # In production, either leave unset (0.0.0.0) or set to a specific interface.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
74 SERVER_HOST=127.0.0.1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
75
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
76 # ─────────────────────────────────────────────────────────────────────────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
77 # Guest inference quota — enable guest inference at runtime via the environment:
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
78 # MRJUNEJUNE_ALLOW_GUEST_INFERENCE=1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
79 # These integer values control per-guest rate limits.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
80 # Malformed or out-of-range values cause startup failure.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
81 # AUTH_GUEST_DAILY_TURNS=10
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
82 # AUTH_GUEST_DAILY_OUTPUT_TOKENS=20000
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
83 # AUTH_GUEST_REQUEST_OUTPUT_TOKENS=2048
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
84
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
85 # ─────────────────────────────────────────────────────────────────────────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
86 # OPERATIONAL NOTES
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
87 #
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
88 # Bootstrap password rotation:
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
89 # After the bootstrap admin logs in for the first time, change the password
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
90 # via the /account/password page. To rotate the bootstrap credential itself:
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
91 # 1. Generate a new hash: bazel run //auth:hash_password
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
92 # 2. Update AUTH_BOOTSTRAP_PASSWORD_HASH in .config.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
93 # 3. Use Admin_API or SQL to reset the stored hash for the admin user.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
94 # (Bootstrap only creates the user on first startup when no admin exists.)
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
95 #
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
96 # Guest data retention:
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
97 # Guest identity rows accumulate in the auth SQLite database. Rows expire
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
98 # after AUTH_GUEST_TTL seconds from last activity. Auth_Store automatically
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
99 # skips expired rows on reads; periodic cleanup of very old rows can be done
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
100 # with: DELETE FROM guest_identities WHERE expires_at < strftime('%s','now');
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
101 # Run this against the auth database (DB_PATH, default mrjunejune/data/).
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
102 #
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
103 # Secure cookie policy:
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
104 # Production deployments must NOT set AUTH_DEV_INSECURE_COOKIE=true.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
105 # Ensure your reverse proxy terminates TLS and forwards via SERVER_HOST.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 200
diff changeset
106 # The Secure cookie attribute is enforced automatically on non-loopback hosts.