04/18 Enhance app (security, performance)

2026-04-18 13:20:04 -04:00
parent b51468661e
commit 4d3f9844f0
14 changed files with 529 additions and 7 deletions
@@ -29,7 +29,17 @@ class BaseConfig:
    ARGON2_MEMORY_COST = int(os.environ.get('ARGON2_MEMORY_COST', 65536))
    ARGON2_PARALLELISM = int(os.environ.get('ARGON2_PARALLELISM', 4))

-    RATELIMIT_STORAGE_URI = 'memory://'
+    # Server-side AES-256-GCM key for encrypting TOTP secrets at rest.
+    # Must be a 64-character hex string (32 bytes).
+    # Generate: python -c "import secrets; print(secrets.token_hex(32))"
+    TOTP_ENCRYPTION_KEY = os.environ.get('TOTP_ENCRYPTION_KEY', '')
+
+    # Rate limiting — use Redis in production so all Gunicorn workers share one counter.
+    # Falls back to memory (per-worker, dev only).
+    RATELIMIT_STORAGE_URI = os.environ.get('RATELIMIT_STORAGE_URI', 'memory://')
+
+    # CORS — restrict to the production origin in production config.
+    CORS_ORIGINS = os.environ.get('CORS_ORIGINS', '*')


 class DevelopmentConfig(BaseConfig):