Mercurial

comparison mrjunejune/.config.development @ 264:04fee26ecce0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
add authenticated JRPG conversation platform Add reusable auth/session storage, owned conversation recovery, guest quotas, admin workflows, URL-routed conversation UI, mobile frame support, and parallel browser acceptance. Co-authored-by: Copilot <[email protected]>
author MrJuneJune <me@mrjunejune.com>
date Fri, 07 Aug 2026 07:34:12 -0700
parents 90dfcef375fb
children 056790c4fb0d
comparison
equal deleted inserted replaced
263:ee04e4e69fed 264:04fee26ecce0
1 # MrJuneJune Server Configuration 1 # MrJuneJune Server Configuration — DEVELOPMENT TEMPLATE
2 2 #
3 # This file is a copyable filler only. It contains no real secrets, hashes,
4 # or credentials. Copy it to .config (which is VCS-ignored) and fill in your
5 # local values before starting the server.
6 #
7 # cp mrjunejune/.config.development mrjunejune/.config
8 #
9 # ─────────────────────────────────────────────────────────────────────────────
3 # Auth token for S3 upload API 10 # Auth token for S3 upload API
4 # Client must send this in Authorization header: Bearer <token> 11 # Client must send: Authorization: Bearer <token>
5 UPLOAD_AUTH_TOKEN=THIS 12 UPLOAD_AUTH_TOKEN=REPLACE_WITH_LOCAL_TOKEN
6 13
7 # S3 Configuration 14 # S3 Configuration
8 S3_REGION=THIS 15 S3_REGION=REPLACE_WITH_REGION
9 S3_BUCKET=THIS 16 S3_BUCKET=REPLACE_WITH_BUCKET
10 17
11 # Presigned URL expiration (seconds) 18 # Presigned URL expiration (seconds)
12 S3_URL_EXPIRES=SECONDS 19 S3_URL_EXPIRES=3600
20
21 # ─────────────────────────────────────────────────────────────────────────────
22 # Auth — all AUTH_* values may also be set as environment variables; env takes
23 # precedence over this file. Never commit real values here.
24 #
25 # AUTH_COOKIE_SECRET
26 # A cryptographically random 32-byte secret encoded as a lowercase hex string
27 # (64 hex chars). Used to sign session and guest cookies via HMAC-SHA-256.
28 # Generate with:
29 # openssl rand -hex 32
30 # Minimum: 64 hex chars (32 bytes). Maximum: 2048 hex chars (1024 bytes).
31 AUTH_COOKIE_SECRET=REPLACE_WITH_OUTPUT_OF_openssl_rand_hex_32
32
33 # AUTH_BOOTSTRAP_USERNAME / AUTH_BOOTSTRAP_PASSWORD_HASH
34 # Creates the initial admin account on first startup if no admin exists yet.
35 # Both must be set together, or both must be absent.
36 # Generate the hash with:
37 # bazel run //auth:hash_password
38 # Then enter the desired bootstrap password at the prompt.
39 # Example format (do not use this value — it is a public test fixture):
40 # zenbu-scrypt$v=1$N=32768$r=8$p=1$<salt>$<hash>
41 AUTH_BOOTSTRAP_USERNAME=admin
42 AUTH_BOOTSTRAP_PASSWORD_HASH=REPLACE_WITH_OUTPUT_OF_bazel_run_//auth:hash_password
43
44 # AUTH_TRUSTED_PROXY
45 # Exact direct-peer IP address of your reverse proxy (e.g. nginx/Caddy).
46 # When set, the server trusts X-Real-IP from this peer for client-IP binding.
47 # Leave commented out if the server receives direct connections.
48 # Must be a valid IPv4 or IPv6 address.
49 # AUTH_TRUSTED_PROXY=10.0.0.1
50
51 # AUTH_SESSION_IDLE_TTL / AUTH_SESSION_ABS_TTL
52 # Idle TTL: seconds since last request before a session expires (default 7 d).
53 # Abs TTL: absolute session lifetime regardless of activity (default 30 d).
54 # Idle must not exceed Abs. Both must be 60–31536000.
55 # AUTH_SESSION_IDLE_TTL=604800
56 # AUTH_SESSION_ABS_TTL=2592000
57
58 # AUTH_GUEST_TTL
59 # Lifetime of a guest identity record in seconds (default 30 d).
60 # AUTH_GUEST_TTL=2592000
61
62 # AUTH_DEV_INSECURE_COOKIE
63 # Set to true to issue cookies without the Secure attribute.
64 # ONLY valid when SERVER_HOST is a loopback address (127.0.0.1, ::1, or localhost).
65 # Must NOT be set in production or on a non-loopback bind.
66 AUTH_DEV_INSECURE_COOKIE=true
67
68 # ─────────────────────────────────────────────────────────────────────────────
69 # SERVER_HOST
70 # IP address the server listens on. Defaults to 0.0.0.0 (all interfaces).
71 # For local development, set to 127.0.0.1 — required when
72 # AUTH_DEV_INSECURE_COOKIE=true.
73 # In production, either leave unset (0.0.0.0) or set to a specific interface.
74 SERVER_HOST=127.0.0.1
75
76 # ─────────────────────────────────────────────────────────────────────────────
77 # Guest inference quota — enable guest inference at runtime via the environment:
78 # MRJUNEJUNE_ALLOW_GUEST_INFERENCE=1
79 # These integer values control per-guest rate limits.
80 # Malformed or out-of-range values cause startup failure.
81 # AUTH_GUEST_DAILY_TURNS=10
82 # AUTH_GUEST_DAILY_OUTPUT_TOKENS=20000
83 # AUTH_GUEST_REQUEST_OUTPUT_TOKENS=2048
84
85 # ─────────────────────────────────────────────────────────────────────────────
86 # OPERATIONAL NOTES
87 #
88 # Bootstrap password rotation:
89 # After the bootstrap admin logs in for the first time, change the password
90 # via the /account/password page. To rotate the bootstrap credential itself:
91 # 1. Generate a new hash: bazel run //auth:hash_password
92 # 2. Update AUTH_BOOTSTRAP_PASSWORD_HASH in .config.
93 # 3. Use Admin_API or SQL to reset the stored hash for the admin user.
94 # (Bootstrap only creates the user on first startup when no admin exists.)
95 #
96 # Guest data retention:
97 # Guest identity rows accumulate in the auth SQLite database. Rows expire
98 # after AUTH_GUEST_TTL seconds from last activity. Auth_Store automatically
99 # skips expired rows on reads; periodic cleanup of very old rows can be done
100 # with: DELETE FROM guest_identities WHERE expires_at < strftime('%s','now');
101 # Run this against the auth database (DB_PATH, default mrjunejune/data/).
102 #
103 # Secure cookie policy:
104 # Production deployments must NOT set AUTH_DEV_INSECURE_COOKIE=true.
105 # Ensure your reverse proxy terminates TLS and forwards via SERVER_HOST.
106 # The Secure cookie attribute is enforced automatically on non-loopback hosts.