mirror of
https://github.com/AmruthPillai/Reactive-Resume.git
synced 2026-06-22 04:11:55 +10:00
Amruth Pillai
a42dbcd452
Add stricter URL and redirect validation, endpoint rate limiting, safer defaults for printer and compose config, and CSP protections across server and API surfaces. Made-with: Cursor
93 lines
3.3 KiB
Bash
93 lines
3.3 KiB
Bash
# --- Server ---
|
|
TZ="Etc/UTC"
|
|
APP_URL="http://localhost:3000"
|
|
|
|
# Optional, uses APP_URL by default
|
|
# PLEASE READ: This should be set to an internal URL (like http://host.docker.internal:3000 or http://{docker_service}:3000)
|
|
# to let the browser navigate to a non-public instance of Reactive Resume.
|
|
# This is required when the printer service is running inside Docker, and cannot reach the app via the APP URL,
|
|
# which is usually when the APP_URL is localhost or a local network IP/hostname.
|
|
PRINTER_APP_URL="http://host.docker.internal:3000"
|
|
|
|
# --- Printer ---
|
|
PRINTER_ENDPOINT="ws://localhost:4000?token=change-me"
|
|
|
|
# --- Database (PostgreSQL) ---
|
|
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"
|
|
|
|
# --- Authentication ---
|
|
# Generated using `openssl rand -hex 32`
|
|
AUTH_SECRET="change-me-to-a-secure-secret-key-in-production"
|
|
|
|
# Better Auth Dashboard (optional)
|
|
BETTER_AUTH_API_KEY=""
|
|
|
|
# Social Auth (Google, optional)
|
|
GOOGLE_CLIENT_ID=""
|
|
GOOGLE_CLIENT_SECRET=""
|
|
|
|
# Social Auth (GitHub, optional)
|
|
GITHUB_CLIENT_ID=""
|
|
GITHUB_CLIENT_SECRET=""
|
|
|
|
# Social Auth (LinkedIn, optional)
|
|
LINKEDIN_CLIENT_ID=""
|
|
LINKEDIN_CLIENT_SECRET=""
|
|
|
|
# Custom OAuth Provider (optional)
|
|
OAUTH_PROVIDER_NAME=""
|
|
OAUTH_CLIENT_ID=""
|
|
OAUTH_CLIENT_SECRET=""
|
|
OAUTH_DISCOVERY_URL=""
|
|
OAUTH_AUTHORIZATION_URL=""
|
|
OAUTH_DYNAMIC_CLIENT_REDIRECT_HOSTS=""
|
|
|
|
# AI provider base URL allowlist (optional, comma-separated hosts/origins)
|
|
# Example: api.openai.com,https://gateway.ai.vercel.com
|
|
AI_ALLOWED_BASE_URLS=""
|
|
|
|
# --- Email (optional) ---
|
|
# If all keys are disabled, the app logs the email to be sent to the console instead.
|
|
SMTP_HOST="localhost"
|
|
SMTP_PORT="1025"
|
|
SMTP_USER=""
|
|
SMTP_PASS=""
|
|
SMTP_FROM="Reactive Resume <noreply@rxresu.me>"
|
|
SMTP_SECURE="false"
|
|
|
|
# --- Storage (optional) ---
|
|
# If all keys are disabled, the app uses local filesystem (/data) to store uploads instead.
|
|
# Make sure to mount this directory to a volume or the host filesystem to ensure data integrity.
|
|
|
|
# Seaweedfs
|
|
S3_ACCESS_KEY_ID="seaweedfs"
|
|
S3_SECRET_ACCESS_KEY="seaweedfs"
|
|
S3_REGION="us-east-1"
|
|
S3_ENDPOINT="http://localhost:8333"
|
|
S3_BUCKET="reactive-resume"
|
|
S3_FORCE_PATH_STYLE="true"
|
|
|
|
# --- Feature Flags ---
|
|
# This flag bypasses the check that the endpoint to fetch data for the printing of PDFs `getByIdForPrinter`, is only accessible from the server.
|
|
# Useful for when you want to debug the /printer/{resumeId} route to quickly take a peek at the page that is sent to the printer.
|
|
FLAG_DEBUG_PRINTER="false"
|
|
|
|
# This flag disables new signups, both on the web app and the server.
|
|
FLAG_DISABLE_SIGNUPS="false"
|
|
|
|
# This flag disables email/password login. Disables email verification, forgot password, and reset password flows. Users can still sign up via social auth (Google/GitHub/Custom OAuth), unless FLAG_DISABLE_SIGNUPS is also set to true.
|
|
FLAG_DISABLE_EMAIL_AUTH="false"
|
|
|
|
# This flag disables the image processing.
|
|
# This is useful if you are using a machine with limited resources, like a Raspberry Pi.
|
|
FLAG_DISABLE_IMAGE_PROCESSING="false"
|
|
|
|
# --- Others ---
|
|
# Google Cloud API Key (optional)
|
|
# This is not used within Reactive Resume, but in src/scripts/fonts/generate.ts to generate a list of fonts served by Google Fonts.
|
|
# Note: Make sure "Google Fonts Developer API" is unrestricted.
|
|
GOOGLE_CLOUD_API_KEY=""
|
|
|
|
# --- Crowdin ---
|
|
CROWDIN_PROJECT_ID=""
|
|
CROWDIN_API_TOKEN="" |