peter/siftlode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
siftlode/.env.example

63 lines
3 KiB
Text
Raw Normal View History

feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens - docker-compose with Postgres 16 + slim Python API image - FastAPI app with session middleware, health endpoint, static login page - Google OAuth (Authlib) with email invite-list whitelist; admin role support - User + OAuthToken models; refresh tokens encrypted at rest (Fernet) - Alembic migrations, run automatically on container startup - Postgres backup/restore scripts for portability between machines
2026-06-11 01:01:37 +02:00
# ---- Copy this file to .env and fill in the values ----
# Postgres (used by docker-compose for the db service and the DATABASE_URL)
chore: rename remaining subfeed references to siftlode Replace the leftover 'subfeed' name across logger names + log_config, frontend localStorage keys, Postgres user/db/volume defaults in the compose files, .env.example, config.py, backup/restore scripts and the README. Pure rename; no behavioural change. localStorage keys move from subfeed.* to siftlode.* (one-time UI-state reset is acceptable).
2026-06-21 06:53:12 +02:00
POSTGRES_USER=siftlode
feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens - docker-compose with Postgres 16 + slim Python API image - FastAPI app with session middleware, health endpoint, static login page - Google OAuth (Authlib) with email invite-list whitelist; admin role support - User + OAuthToken models; refresh tokens encrypted at rest (Fernet) - Alembic migrations, run automatically on container startup - Postgres backup/restore scripts for portability between machines
2026-06-11 01:01:37 +02:00
POSTGRES_PASSWORD=change-this-password
chore: rename remaining subfeed references to siftlode Replace the leftover 'subfeed' name across logger names + log_config, frontend localStorage keys, Postgres user/db/volume defaults in the compose files, .env.example, config.py, backup/restore scripts and the README. Pure rename; no behavioural change. localStorage keys move from subfeed.* to siftlode.* (one-time UI-state reset is acceptable).
2026-06-21 06:53:12 +02:00
POSTGRES_DB=siftlode
feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens - docker-compose with Postgres 16 + slim Python API image - FastAPI app with session middleware, health endpoint, static login page - Google OAuth (Authlib) with email invite-list whitelist; admin role support - User + OAuthToken models; refresh tokens encrypted at rest (Fernet) - Alembic migrations, run automatically on container startup - Postgres backup/restore scripts for portability between machines
2026-06-11 01:01:37 +02:00
# Host port the app is exposed on (http://localhost:<APP_PORT>)
APP_PORT=8080
# Session signing key. Generate with: python -c "import secrets;print(secrets.token_urlsafe(48))"
feat(auth): split base sign-in from YouTube scopes for incremental onboarding Base login now requests only openid/email/profile (non-sensitive), so a new user gets a clean Google consent with no "unverified app" warning and no 7-day refresh token expiry. YouTube read (youtube.readonly) and write (youtube) are granted later by the onboarding wizard via a parameterized /auth/upgrade?access=read|write. Security fixes folded in from the baseline audit: - config: refuse to boot in production (https OAUTH_REDIRECT_URL) with the placeholder/short SECRET_KEY or a missing TOKEN_ENCRYPTION_KEY, closing a session-forgery / admin-impersonation hole. - main: mark the session cookie Secure when served over HTTPS. - me: expose can_read; sync/subscriptions returns a friendly 403 (not a 500) until YouTube read access is granted.
2026-06-13 23:56:34 +02:00
# In production (an https OAUTH_REDIRECT_URL) the app refuses to start with this placeholder
# or any key shorter than 32 chars — a known signing key would let anyone forge a session.
feat: M1 foundation — compose stack, FastAPI, Google OAuth, encrypted tokens - docker-compose with Postgres 16 + slim Python API image - FastAPI app with session middleware, health endpoint, static login page - Google OAuth (Authlib) with email invite-list whitelist; admin role support - User + OAuthToken models; refresh tokens encrypted at rest (Fernet) - Alembic migrations, run automatically on container startup - Postgres backup/restore scripts for portability between machines
2026-06-11 01:01:37 +02:00
SECRET_KEY=change-me-session-key
# Fernet key for encrypting stored OAuth refresh tokens. Generate with:
# python -c "import base64,os;print(base64.urlsafe_b64encode(os.urandom(32)).decode())"
TOKEN_ENCRYPTION_KEY=change-me-fernet-key
# Google OAuth client (Google Cloud Console -> APIs & Services -> Credentials -> OAuth client ID, type "Web application").
# Authorized redirect URI must match OAUTH_REDIRECT_URL exactly.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
OAUTH_REDIRECT_URL=http://localhost:8080/auth/callback
# Invite list: only these Google account emails may sign in (comma-separated).
ALLOWED_EMAILS=
# Admin emails (subset of the above) get the admin role.
ADMIN_EMAILS=
# Optional: origin of a separately-served frontend dev server (enables CORS). Leave empty in production.
FRONTEND_ORIGIN=
feat(deploy): shared database + scheduler split for the server 24/7 backfill Add a server compose (full stack, Postgres on the LAN, scheduler on, host-visible pgdata bind mount) and a localdev compose (webapp only, no DB, scheduler off) that points at the shared database. Document the shared-database topology, the exactly-one-scheduler rule, and YOUTUBE_API_KEY for unattended backfill that does not depend on a 7-day OAuth refresh token.
2026-06-11 16:35:00 +02:00
# Optional YouTube Data API key (Google Cloud Console -> Credentials -> Create API key).
# When set, all public reads (channels/videos/playlist backfill + enrichment) use the key
# instead of a user's OAuth token, so 24/7 backfill never depends on a refresh token that
# would otherwise expire (Google expires refresh tokens after 7 days while the OAuth consent
# screen is in "Testing"). Strongly recommended for the always-on server instance.
YOUTUBE_API_KEY=
feat(m5c): onboarding — DB invites, request-access, admin approval, email Move the access whitelist from the ALLOWED_EMAILS env var into a DB Invite table (env kept as bootstrap fallback), and add a self-service request + admin approval flow with fail-soft email. - models: Invite(email, status pending|approved|denied, requested_at, decided_*) - migration 0008: invites table; seed env ALLOWED_EMAILS u ADMIN_EMAILS as approved - auth: is_allowed() (DB-first, env fallback); a denied Google login records a pending request and bounces to /?access=requested instead of a raw 403; public POST /auth/request-access; upsert is idempotent so repeats don't re-spam admins - routes/admin.py (admin-only): list/approve/deny invites + manual add - email.py: smtplib + Gmail App Password, fail-soft (skips if SMTP unset) - /api/me exposes pending_invites; config + .env.example gain SMTP_* - UI: Login 'Request access' form + access=requested/denied handling; Settings -> Access requests (approve/deny + add); admin nudge toast on pending requests Verified locally: request-access creates a pending invite and emails the admin; seed approved npeter83; guinea-pig yt.trash2023 denied until approved.
2026-06-12 01:43:07 +02:00
# Optional: outbound email for onboarding (access-request + approval notices). Gmail SMTP +
# App Password (account needs 2FA; generate at https://myaccount.google.com/apppasswords under
# the SENDING account). All optional — if unset, email is skipped and onboarding still works
# via in-app notifications. SMTP_FROM falls back to SMTP_USER.
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=
feat(deploy): shared database + scheduler split for the server 24/7 backfill Add a server compose (full stack, Postgres on the LAN, scheduler on, host-visible pgdata bind mount) and a localdev compose (webapp only, no DB, scheduler off) that points at the shared database. Document the shared-database topology, the exactly-one-scheduler rule, and YOUTUBE_API_KEY for unattended backfill that does not depend on a 7-day OAuth refresh token.
2026-06-11 16:35:00 +02:00
# --- Deployment role ---
# DATABASE_URL is set automatically by docker-compose.yml / docker-compose.server.yml to the
# bundled `db` service. Override it only for local dev against the central server DB, e.g.:
chore: rename remaining subfeed references to siftlode Replace the leftover 'subfeed' name across logger names + log_config, frontend localStorage keys, Postgres user/db/volume defaults in the compose files, .env.example, config.py, backup/restore scripts and the README. Pure rename; no behavioural change. localStorage keys move from subfeed.* to siftlode.* (one-time UI-state reset is acceptable).
2026-06-21 06:53:12 +02:00
# DATABASE_URL=postgresql+psycopg://siftlode:<password>@your-db-host:5432/siftlode
feat(deploy): shared database + scheduler split for the server 24/7 backfill Add a server compose (full stack, Postgres on the LAN, scheduler on, host-visible pgdata bind mount) and a localdev compose (webapp only, no DB, scheduler off) that points at the shared database. Document the shared-database topology, the exactly-one-scheduler rule, and YOUTUBE_API_KEY for unattended backfill that does not depend on a 7-day OAuth refresh token.
2026-06-11 16:35:00 +02:00
# Exactly one instance may run the background scheduler. The central server keeps it on; every
# other instance (local dev, etc.) must set SCHEDULER_ENABLED=false. The compose files set this
# for you (server=true via docker-compose.server.yml, local=false via docker-compose.localdev.yml).
SCHEDULER_ENABLED=true
# On the central server, set this so backup.sh / restore.sh and plain `docker compose` commands
# target the server stack automatically:
# COMPOSE_FILE=docker-compose.server.yml
Reference in a new issue Copy permalink