mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-21 11:03:19 +00:00
ignacionelson
85b1650ef0
The dashboard's System card now says so when no scanner is configured at all, not only when a configured one is failing: "Anything uploaded here — by staff, by clients, or through an upload link — is passed on unchecked", with a link to set it up. Said only where somebody can act on it. Connecting a scanner is a new capability, scanning.connect, community only — on a hosted installation the scanner is infrastructure the platform runs, so its address is not a tenant's to set and its absence is not a tenant's to fix. The two policies stay on both editions, because what to do with a file nobody could scan is a decision about somebody's own files. An edition difference through the registry, never an edition check. Also: PROJECTSEND_SCANNER_DEFAULT_ADDRESS, seeded into the settings on first boot by the command that already does this for two-factor enforcement. It is the opposite of PROJECTSEND_SCANNER_ADDRESS — a starting value rather than a policy, so a Docker install that brings up the optional scanner container arrives configured while the address and the switch stay on the settings screen. Both are seeded together or neither: an address with scanning off would look configured and check nothing. Nothing changes for an existing installation on upgrade: scanning stays off, existing files are marked "never scanned", and the scanner container is still opt-in.
128 lines
4.1 KiB
Bash
128 lines
4.1 KiB
Bash
APP_NAME=ProjectSend
|
|
PROJECTSEND_EDITION=community
|
|
|
|
# Emergency off switch for the CAPTCHA on public forms, for an operator who
|
|
# has a shell but no working login. Everything else about the feature is
|
|
# configured at /system/settings/captcha.
|
|
#
|
|
# Only "true" or "1" switches it off. Anything else -- including "no",
|
|
# "off", and a misspelling -- leaves the CAPTCHA on, deliberately: a flag
|
|
# that takes a protection away should not do so because a value was typed
|
|
# wrong.
|
|
# PROJECTSEND_CAPTCHA_DISABLED=true
|
|
|
|
# How downloads leave the server. Left unset (or "auto"), ProjectSend hands
|
|
# files to nginx when it is running behind nginx, and streams them through
|
|
# PHP on anything else -- which works everywhere but holds a PHP worker for
|
|
# the whole of each download. Set "xsendfile" for Apache with mod_xsendfile
|
|
# (or LiteSpeed) once XSendFilePath allows storage/app/files, "nginx" when
|
|
# an nginx proxy in front is the one serving /protected-files/, or "php" to
|
|
# stream deliberately. The dashboard's System panel shows which is in use.
|
|
# PROJECTSEND_FILE_DELIVERY=auto
|
|
|
|
# Optional: the virus scanner every upload is checked against, as
|
|
# tcp://host:3310 or unix:///path/to/clamd.sock. Naming it here makes
|
|
# scanning managed: it is used, it cannot be switched off from the settings
|
|
# screen, and the address does not appear there. Leave it unset to
|
|
# configure scanning in Settings instead, which is the ordinary way.
|
|
# PROJECTSEND_SCANNER_ADDRESS=tcp://clamav:3310
|
|
|
|
# Optional: the scanner a fresh installation starts out pointed at, written
|
|
# into the settings on first boot and ignored on every later one. Unlike the
|
|
# variable above it leaves both the address and the switch on the settings
|
|
# screen, which is what a self-hosted install wants: configured out of the
|
|
# box, and still yours.
|
|
# PROJECTSEND_SCANNER_DEFAULT_ADDRESS=tcp://clamav:3310
|
|
|
|
# Optional: uid/gid the app/web containers' internal user runs as, so the
|
|
# bind-mounted repo needs no permission fixes. Defaults to 1000; override
|
|
# if your host user's `id -u`/`id -g` differ.
|
|
# WWWUSER=1000
|
|
# WWWGROUP=1000
|
|
|
|
# Optional: create the first administrator unattended on container start.
|
|
# Leave unset to use the first-run setup screen instead.
|
|
# ADMIN_NAME="Administrator"
|
|
# ADMIN_EMAIL=admin@example.com
|
|
# ADMIN_PASSWORD=
|
|
APP_ENV=local
|
|
APP_KEY=
|
|
APP_DEBUG=true
|
|
APP_TIMEZONE=UTC
|
|
APP_URL=http://localhost
|
|
|
|
# Required whenever a proxy/load balancer sits in front of this app (an
|
|
# ALB, Cloudflare, a hosted ingress) — otherwise every request looks like
|
|
# it comes from the proxy, collapsing per-IP rate limits and the download
|
|
# IP log. Comma-separated addresses/CIDRs, or "*" to trust any proxy
|
|
# (only safe when nothing but the proxy can reach the app).
|
|
# TRUSTED_PROXIES=
|
|
|
|
APP_LOCALE=en
|
|
APP_FALLBACK_LOCALE=en
|
|
APP_FAKER_LOCALE=en_US
|
|
|
|
APP_MAINTENANCE_DRIVER=file
|
|
# APP_MAINTENANCE_STORE=database
|
|
|
|
PHP_CLI_SERVER_WORKERS=4
|
|
|
|
BCRYPT_ROUNDS=12
|
|
|
|
LOG_CHANNEL=stack
|
|
LOG_STACK=single
|
|
LOG_DEPRECATIONS_CHANNEL=null
|
|
LOG_LEVEL=debug
|
|
|
|
DB_CONNECTION=mysql
|
|
DB_HOST=db
|
|
DB_PORT=3306
|
|
DB_DATABASE=projectsend
|
|
DB_USERNAME=projectsend
|
|
DB_PASSWORD=secret
|
|
|
|
SESSION_DRIVER=redis
|
|
SESSION_LIFETIME=120
|
|
SESSION_ENCRYPT=false
|
|
SESSION_PATH=/
|
|
SESSION_DOMAIN=null
|
|
|
|
BROADCAST_CONNECTION=log
|
|
FILESYSTEM_DISK=local
|
|
|
|
# Set this only if your web server and PHP-FPM run as different system
|
|
# users — common on cPanel/Plesk shared hosting. Uploaded files are
|
|
# written 0600 in 0700 directories, which nginx cannot read, and since
|
|
# nginx is what actually streams a download (PHP authorizes, then hands
|
|
# it the path) every download fails while the rest of the site works.
|
|
# Relaxes those to 0644/0755, which every account on the machine can
|
|
# read — leave it off if your web server and PHP are the same user.
|
|
# FILES_WEB_SERVER_READABLE=true
|
|
QUEUE_CONNECTION=redis
|
|
|
|
CACHE_STORE=redis
|
|
CACHE_PREFIX=
|
|
|
|
MEMCACHED_HOST=127.0.0.1
|
|
|
|
REDIS_CLIENT=phpredis
|
|
REDIS_HOST=redis
|
|
REDIS_PASSWORD=null
|
|
REDIS_PORT=6379
|
|
|
|
MAIL_MAILER=smtp
|
|
MAIL_HOST=mailpit
|
|
MAIL_PORT=1025
|
|
MAIL_USERNAME=null
|
|
MAIL_PASSWORD=null
|
|
MAIL_ENCRYPTION=null
|
|
MAIL_FROM_ADDRESS="hello@example.com"
|
|
MAIL_FROM_NAME="${APP_NAME}"
|
|
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
AWS_DEFAULT_REGION=us-east-1
|
|
AWS_BUCKET=
|
|
AWS_USE_PATH_STYLE_ENDPOINT=false
|
|
|