Jul 22 - Update protect admin page with fail2ban

config.py

@@ -1,28 +1,6 @@
 import os
 
 
-def _load_dotenv():
-    """Load KEY=value lines from a .env beside this file into the environment,
-    with NO variable expansion. Werkzeug password hashes contain '$', which
-    shell-style interpolation corrupts. Vars already set (e.g. by systemd) win."""
-    path = os.path.join(os.path.dirname(os.path.abspath(__file__)), ".env")
-    if not os.path.exists(path):
-        return
-    with open(path, encoding="utf-8") as fh:
-        for raw in fh:
-            line = raw.strip()
-            if not line or line.startswith("#") or "=" not in line:
-                continue
-            key, val = line.split("=", 1)
-            key, val = key.strip(), val.strip()
-            if len(val) >= 2 and val[0] == val[-1] and val[0] in ("'", '"'):
-                val = val[1:-1]
-            os.environ.setdefault(key, val)
-
-
-_load_dotenv()
-
-
 class Config:
     # Build the SQLAlchemy URI from discrete env vars, or accept a full DATABASE_URL.
     DB_USER = os.environ.get("DB_USER", "jqc_features")
@@ -42,11 +20,18 @@ class Config:
     DEMO_CONTACT_URL = os.environ.get("DEMO_CONTACT_URL", "mailto:info@ltservicesinc.com")
 
     # --- Admin / session ---
+    # SECRET_KEY signs session cookies and CSRF tokens. MUST be set in production.
     SECRET_KEY = os.environ.get("SECRET_KEY", "dev-only-insecure-change-me")
 
+    # Single admin account. Password is stored ONLY as a Werkzeug hash — never plaintext.
+    # Generate a hash:  python3 -c "from werkzeug.security import generate_password_hash as g; print(g('yourpassword'))"
     ADMIN_USERNAME = os.environ.get("ADMIN_USERNAME", "admin")
     ADMIN_PASSWORD_HASH = os.environ.get("ADMIN_PASSWORD_HASH", "")
 
+    # Cookie hardening. SESSION_COOKIE_SECURE must be true once served over HTTPS.
     SESSION_COOKIE_HTTPONLY = True
     SESSION_COOKIE_SAMESITE = "Lax"
-    SESSION_COOKIE_SECURE = os.environ.get("SESSION_COOKIE_SECURE", "1") == "1"
+    SESSION_COOKIE_SECURE = os.environ.get("SESSION_COOKIE_SECURE", "1") == "1"
+
+    # Path to the auth log fail2ban watches. Empty -> <appdir>/logs/auth.log
+    AUTH_LOG_PATH = os.environ.get("AUTH_LOG_PATH", "")