38 lines
1.7 KiB
Python
38 lines
1.7 KiB
Python
import os
|
|
|
|
|
|
class Config:
|
|
# Build the SQLAlchemy URI from discrete env vars, or accept a full DATABASE_URL.
|
|
DB_USER = os.environ.get("DB_USER", "jqc_features")
|
|
DB_PASSWORD = os.environ.get("DB_PASSWORD", "")
|
|
DB_HOST = os.environ.get("DB_HOST", "127.0.0.1")
|
|
DB_PORT = os.environ.get("DB_PORT", "3306")
|
|
DB_NAME = os.environ.get("DB_NAME", "jqc_features")
|
|
|
|
SQLALCHEMY_DATABASE_URI = os.environ.get(
|
|
"DATABASE_URL",
|
|
f"mysql+pymysql://{DB_USER}:{DB_PASSWORD}@{DB_HOST}:{DB_PORT}/{DB_NAME}?charset=utf8mb4",
|
|
)
|
|
SQLALCHEMY_TRACK_MODIFICATIONS = False
|
|
SQLALCHEMY_ENGINE_OPTIONS = {"pool_pre_ping": True, "pool_recycle": 280}
|
|
|
|
# Public contact button target shown in the closing CTA.
|
|
DEMO_CONTACT_URL = os.environ.get("DEMO_CONTACT_URL", "mailto:info@ltservicesinc.com")
|
|
|
|
# --- Admin / session ---
|
|
# SECRET_KEY signs session cookies and CSRF tokens. MUST be set in production.
|
|
SECRET_KEY = os.environ.get("SECRET_KEY", "dev-only-insecure-change-me")
|
|
|
|
# Single admin account. Password is stored ONLY as a Werkzeug hash — never plaintext.
|
|
# Generate a hash: python3 -c "from werkzeug.security import generate_password_hash as g; print(g('yourpassword'))"
|
|
ADMIN_USERNAME = os.environ.get("ADMIN_USERNAME", "admin")
|
|
ADMIN_PASSWORD_HASH = os.environ.get("ADMIN_PASSWORD_HASH", "")
|
|
|
|
# Cookie hardening. SESSION_COOKIE_SECURE must be true once served over HTTPS.
|
|
SESSION_COOKIE_HTTPONLY = True
|
|
SESSION_COOKIE_SAMESITE = "Lax"
|
|
SESSION_COOKIE_SECURE = os.environ.get("SESSION_COOKIE_SECURE", "1") == "1"
|
|
|
|
# Path to the auth log fail2ban watches. Empty -> <appdir>/logs/auth.log
|
|
AUTH_LOG_PATH = os.environ.get("AUTH_LOG_PATH", "")
|