Sam Rolfe
c83c9df0a3
- Go service with its own multi-stage Dockerfile and docker-compose.yml; runs as container webrestrict-control on port 8791. - SQLite schema for the full AGENTS.md §7 data model via versioned migrations (PRAGMA user_version); audit log is append-only. - Configuration from the process environment; the real env file is gitignored and a template is committed. No secrets in the repo. - Separate session login (signed HMAC cookie + CSRF) for Sam. - GET /health; HTMX + server-rendered dashboard styled with the Family Home Lab tokens.css (copied) and Inter fonts; dark mode; phone-friendly. - Caddy vhost for webrestrict.lab.audasmedia.com.au applied on .35 (Let's Encrypt cert issued); route recorded in deploy/caddy/webrestrict.caddy. - Unit tests for config, auth and store. Co-Authored-By: Paperclip <noreply@paperclip.ing>
39 lines
1.3 KiB
Plaintext
39 lines
1.3 KiB
Plaintext
# Control Service configuration — template.
|
|
#
|
|
# Copy to control-service.env and fill in real values. The real file is
|
|
# gitignored and must never be committed. docker compose loads it with env_file.
|
|
#
|
|
# Secrets in this lab also live in ~/.config/environment.d/10-secrets.conf; the
|
|
# same variable names can be exported there instead. The service reads only the
|
|
# process environment, so either source works.
|
|
|
|
# Listen address inside the container.
|
|
CONTROL_ADDR=:8791
|
|
|
|
# SQLite database on the persistent volume.
|
|
CONTROL_DB_PATH=/data/control.db
|
|
|
|
CONTROL_APP_ENV=production
|
|
CONTROL_LOG_LEVEL=info
|
|
|
|
# Signs the session cookie. Set to a long random string (>= 16 chars).
|
|
# Generate: openssl rand -hex 32
|
|
CONTROL_SESSION_SECRET=change-me-to-a-long-random-string
|
|
|
|
# Session lifetime (Go duration).
|
|
CONTROL_SESSION_TTL=12h
|
|
|
|
# Secure cookie flag. Keep true behind Caddy/HTTPS. Set false only for
|
|
# plain-HTTP local testing.
|
|
CONTROL_COOKIE_SECURE=true
|
|
|
|
# The single dashboard login (Sam).
|
|
CONTROL_ADMIN_USERNAME=sam
|
|
|
|
# Option A (simple): plaintext password. Constant-time compared at login.
|
|
CONTROL_ADMIN_PASSWORD=change-me
|
|
|
|
# Option B (preferred): a bcrypt hash; leave CONTROL_ADMIN_PASSWORD empty.
|
|
# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.1.0-phase1 hash-password 'your-password'
|
|
# CONTROL_ADMIN_PASSWORD_HASH=$2a$10$...
|