63 lines
2.1 KiB
Python
63 lines
2.1 KiB
Python
import os
|
|
from datetime import timedelta
|
|
from dotenv import load_dotenv
|
|
|
|
load_dotenv()
|
|
|
|
|
|
class BaseConfig:
|
|
SECRET_KEY = os.environ.get('SECRET_KEY', 'dev-secret-change-me')
|
|
JWT_SECRET_KEY = os.environ.get('JWT_SECRET_KEY', 'jwt-secret-change-me')
|
|
JWT_ACCESS_TOKEN_EXPIRES = timedelta(minutes=15)
|
|
JWT_REFRESH_TOKEN_EXPIRES = timedelta(days=7)
|
|
|
|
SQLALCHEMY_DATABASE_URI = (
|
|
'mysql+pymysql://{user}:{password}@{host}:{port}/{db}?charset=utf8mb4'.format(
|
|
user=os.environ.get('MYSQL_USER', 'passkeeper'),
|
|
password=os.environ.get('MYSQL_PASSWORD', ''),
|
|
host=os.environ.get('MYSQL_HOST', '127.0.0.1'),
|
|
port=os.environ.get('MYSQL_PORT', '3306'),
|
|
db=os.environ.get('MYSQL_DB', 'passkeeper'),
|
|
)
|
|
)
|
|
SQLALCHEMY_TRACK_MODIFICATIONS = False
|
|
|
|
WTF_CSRF_ENABLED = True
|
|
WTF_CSRF_TIME_LIMIT = 3600
|
|
|
|
ARGON2_TIME_COST = int(os.environ.get('ARGON2_TIME_COST', 3))
|
|
ARGON2_MEMORY_COST = int(os.environ.get('ARGON2_MEMORY_COST', 65536))
|
|
ARGON2_PARALLELISM = int(os.environ.get('ARGON2_PARALLELISM', 4))
|
|
|
|
# Server-side AES-256-GCM key for encrypting TOTP secrets at rest.
|
|
# Must be a 64-character hex string (32 bytes).
|
|
# Generate: python -c "import secrets; print(secrets.token_hex(32))"
|
|
TOTP_ENCRYPTION_KEY = os.environ.get('TOTP_ENCRYPTION_KEY', '')
|
|
|
|
# Rate limiting — use Redis in production so all Gunicorn workers share one counter.
|
|
# Falls back to memory (per-worker, dev only).
|
|
RATELIMIT_STORAGE_URI = os.environ.get('RATELIMIT_STORAGE_URI', 'memory://')
|
|
|
|
# CORS — restrict to the production origin in production config.
|
|
CORS_ORIGINS = os.environ.get('CORS_ORIGINS', '*')
|
|
|
|
|
|
class DevelopmentConfig(BaseConfig):
|
|
DEBUG = True
|
|
RATELIMIT_ENABLED = False
|
|
|
|
|
|
class ProductionConfig(BaseConfig):
|
|
DEBUG = False
|
|
RATELIMIT_ENABLED = True
|
|
# Force HTTPS in production
|
|
SESSION_COOKIE_SECURE = True
|
|
SESSION_COOKIE_HTTPONLY = True
|
|
SESSION_COOKIE_SAMESITE = 'Lax'
|
|
|
|
|
|
config = {
|
|
'development': DevelopmentConfig,
|
|
'production': ProductionConfig,
|
|
}
|