Sam Rolfe
2ed0ca80ae
- Weblog desktops were unauthenticated and publicly reachable (entry vector) - Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified - Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth) - GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined - Removed /home/sam:ro mount from GIMP (was exposing secrets to the container) - Service-controller restarted (was dead, which is why toggles did nothing) - Incident record + captured payload in docs/incident-2026-11-11*
40 lines
1.4 KiB
Plaintext
40 lines
1.4 KiB
Plaintext
# Family Home Lab — environment template
|
|
# Copy to `.env` (git-ignored) and fill real values. Never commit `.env`.
|
|
|
|
# --- PostgreSQL ---
|
|
POSTGRES_USER=fhl
|
|
POSTGRES_PASSWORD=CHANGE_ME_db
|
|
POSTGRES_DB=fhl
|
|
|
|
# --- Sessions / first-run admin ---
|
|
SESSION_SECRET=CHANGE_ME_openssl_rand_hex_32
|
|
ADMIN_USERNAME=sam
|
|
ADMIN_PASSWORD=CHANGE_ME_admin
|
|
ADMIN_FULLNAME=Sam
|
|
|
|
# --- Garage (S3) ---
|
|
# Generate with: docker run --rm dxflrs/garage:v1.0.1 secret generate
|
|
GARAGE_RPC_SECRET=CHANGE_ME_rpc
|
|
GARAGE_ADMIN_TOKEN=CHANGE_ME_admin_api
|
|
GARAGE_METRICS_TOKEN=CHANGE_ME_metrics
|
|
# First S3 access key pair (main account "portal"). Create via garage CLI after
|
|
# first boot, then paste here.
|
|
S3_ACCESS_KEY=CHANGE_ME_access
|
|
S3_SECRET_KEY=CHANGE_ME_secret
|
|
S3_REGION=garage
|
|
|
|
# --- Tool container images (verify before enabling profile "tools") ---
|
|
IMAGE_GIMP=lscr.io/linuxserver/gimp:latest
|
|
IMAGE_VIDEO=lscr.io/linuxserver/webtop:latest
|
|
IMAGE_AUDIO=lscr.io/linuxserver/webtop:latest
|
|
|
|
# ON/OFF service-controller token (host-side; real value injected at deploy)
|
|
SC_TOKEN=change-me
|
|
|
|
# --- Webtop desktops (GIMP / Kdenlive / Audacity / LMMS) ---
|
|
# Native login for the LinuxServer webtop web desktops. Without these the
|
|
# desktop is served with NO authentication. Also gated at Caddy with
|
|
# `import basic-auth`. Set a long random value; never commit it.
|
|
WEBTOP_USER=family
|
|
WEBTOP_PASSWORD=change-me-to-a-long-random-string
|