iamdoubz
97e67e347d
Two separate reviews of the SSO branch and all 207 API routes (spec 12 §8.6). Every route was guarded as meant. Fixed, each with a test: - login: a directory 503 counts as a failed sign-in; a locked directory account is a refused password, not "unavailable" - open redirect after OpenID sign-in (a tab in next) - directory email matching only for non-admins without their own password; others connect on My settings (POST /api/me/identities/ldap); only admins disconnect a directory account - OpenID session check reads the refreshed ID token's claims too - connect is POST /api/auth/oidc/connect (CSRF header) - stored bind password, client secret and SMTP password tied to their server - 409 role_managed when a provider sets the role; empty Contrack PATCH is a 400 - @fastify/rate-limit on every route (RATE_LIMIT_PER_MINUTE), 10/min on Test buttons; a password asked again shares the login limiter Live tests pass against lldap 0.6.3, Samba 4 AD and Keycloak 26.8.1.
33 lines
1.8 KiB
Bash
33 lines
1.8 KiB
Bash
# --- required ---
|
|
PUBLIC_HOSTNAME=pbx.example.com # DNS name browsers and phones use
|
|
POSTGRES_PASSWORD=change-me # install.sh generates a random one (hex: it goes into a URL)
|
|
AMI_SECRET=change-me # install.sh generates a random one
|
|
APP_SECRET=change-me # 32 random bytes, base64. Encrypts secrets in the DB. NEVER change after first run.
|
|
INITIAL_ADMIN_EMAIL=admin@example.com
|
|
INITIAL_ADMIN_PASSWORD=change-me # only used if no admin exists yet
|
|
|
|
# --- optional ---
|
|
CONTRACK_HOSTNAME= # Contrack contacts (spec 11 §4): its own DNS name, e.g. contacts.example.com
|
|
TZ=America/Chicago
|
|
API_PORT=8080
|
|
POSTGRES_PORT=5433
|
|
APP_UID=1000
|
|
APP_GID=1000
|
|
LOG_LEVEL=info
|
|
TRUST_PROXY=true # true when behind Caddy/nginx
|
|
RATE_LIMIT_PER_MINUTE=600 # requests per minute per client IP, every route; 0 = off
|
|
RTP_PORT_START=10000 # call audio (UDP), both ends included: open this range on the
|
|
RTP_PORT_END=20000 # firewall and router. Two ports per call; 200 is plenty for a small office
|
|
# Local AI (admin guide: AI). Starting values for Settings → AI; that page wins once saved.
|
|
# Only localhost or a local-network IP is accepted. Leave out what you don't use.
|
|
#AI_LLM_URL=http://127.0.0.1:11434/v1 # Ollama
|
|
#AI_LLM_MODEL=qwen3:4b
|
|
#AI_STT_URL=http://127.0.0.1:8000/v1 # deploy/ai (Speaches)
|
|
#AI_STT_MODEL=Systran/faster-whisper-small
|
|
#AI_TTS_URL=http://127.0.0.1:8000/v1
|
|
#AI_TTS_MODEL=speaches-ai/Kokoro-82M-v1.0-ONNX
|
|
#AI_TTS_VOICE=af_heart
|
|
# A private CA your identity provider or directory uses (admin guide: Sign-in). Put the PEM file
|
|
# in data/tls/; the api reads it at start, so restart the api after changing it.
|
|
#NODE_EXTRA_CA_CERTS=/var/lib/selfphoneng/tls/idp-ca.pem
|