Sergei Poljanski
4c10221727
There was no way to put a file up for public use short of running an S3 client with the uploader key. Add a "files" area to the admin: upload one or more files, copy the link, edit the note, replace the contents under the same link, delete. It has its own read/write/delete permission flags like the other areas, and every action is audited. The objects go to the storage stack's public bucket and are served by Garage at s3.asxp.io/public/<key>, not by this app. The app's key can only put and delete there, so a public_files table is the record of what was published. Keys get a random prefix: links are not guessable and names never collide. That host is same-site with the admin, so a file that can carry script must not render there. Only a fixed list of types (images, PDF, plain text, audio, video) is served inline; the rest, HTML and SVG included, is stored as an attachment. Image metadata is stripped by default, as for the bingo photos, because of GPS tags. A per-file limit and a total quota keep the small disk on asxpio-ops from filling up. Assisted-by: Claude:fable-5-2
31 lines
1.1 KiB
Bash
31 lines
1.1 KiB
Bash
RACK_ENV=production
|
|
|
|
# Generate a fresh value: openssl rand -hex 64
|
|
SESSION_SECRET=change-me-to-128-hex-chars
|
|
|
|
SMTP_ADDR=smtp.fastmail.com
|
|
SMTP_PORT=587
|
|
SMTP_USER=me@asxp.io
|
|
SMTP_PASSWORD=change-me
|
|
|
|
MAIL_FROM="IE Sergei Poljanski Contact Form <me@asxp.io>"
|
|
MAIL_TO=ie@asxp.io
|
|
|
|
# Optional: default crypto payout addresses prefilled into the new-invoice
|
|
# form. JSON object, CryptoAsset code => address (codes in lib/crypto_asset.rb).
|
|
# Production sets this from the CRYPTO_ADDRESSES Forgejo secret.
|
|
# CRYPTO_ADDRESSES={"BTC":"bc1...","USDT-TRC20":"T..."}
|
|
# Legacy: LTC_ADDRESS still fills the LTC default when set.
|
|
# LTC_ADDRESS=ltc1...
|
|
|
|
# Public bingo hostname (served by the datacenterbingo repo); used here for
|
|
# IndexNow pings and admin links only.
|
|
# BINGO_HOST=bingo.localhost
|
|
# Bucket and public URL prefix for /admin/files; unset = S3_BUCKET and
|
|
# S3_PUBLIC_ENDPOINT/<bucket>. Limits in MB (defaults 50 and 2048).
|
|
# PUBLIC_S3_BUCKET=public
|
|
# PUBLIC_BASE_URL=https://s3.asxp.io/public
|
|
# PUBLIC_MAX_MB=50
|
|
# PUBLIC_QUOTA_MB=2048
|
|
# IndexNow key (8-128 chars, A-Z a-z 0-9 -); unset = no pings, no key file.
|
|
# INDEXNOW_KEY=
|