mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-23 03:53:21 +00:00
ignacionelson
d11bda094b
The defaults let files through when the scanner cannot answer, so an installation whose scanner died looks, from every screen anybody uses, exactly like one that is working. Three places now say otherwise. `projectsend:status` gains a `scanning` block: whether it is on, whether it is managed, whether the scanner answers right now, the engine and how old its definitions are, what is waiting, what is quarantined, and how many files went out unscanned in the last 24 hours. Absent, null and zero stay distinct — `reachable: null` means there is nothing to reach, `false` means it should be answering and is not. The scans queue is reported beside the other two. The dashboard's System card carries the same warning for whoever is actually looking at a screen, and says nothing at all while scanning is healthy or switched off. Docker gets the scanner as an opt-in profile — `--profile scanner` — in both the development compose file and the published example, with a clamd.conf whose Alert* options are what make an encrypted archive come back as "could not scan" instead of "OK". No published ports: clamd has no authentication and the file crosses that socket in the clear. Both images also run a worker for the scans queue. The dashboard test caught a 500 before it shipped: a nullable return written as `array`.
121 lines
3.8 KiB
Bash
121 lines
3.8 KiB
Bash
APP_NAME=ProjectSend
|
|
PROJECTSEND_EDITION=community
|
|
|
|
# Emergency off switch for the CAPTCHA on public forms, for an operator who
|
|
# has a shell but no working login. Everything else about the feature is
|
|
# configured at /system/settings/captcha.
|
|
#
|
|
# Only "true" or "1" switches it off. Anything else -- including "no",
|
|
# "off", and a misspelling -- leaves the CAPTCHA on, deliberately: a flag
|
|
# that takes a protection away should not do so because a value was typed
|
|
# wrong.
|
|
# PROJECTSEND_CAPTCHA_DISABLED=true
|
|
|
|
# How downloads leave the server. Left unset (or "auto"), ProjectSend hands
|
|
# files to nginx when it is running behind nginx, and streams them through
|
|
# PHP on anything else -- which works everywhere but holds a PHP worker for
|
|
# the whole of each download. Set "xsendfile" for Apache with mod_xsendfile
|
|
# (or LiteSpeed) once XSendFilePath allows storage/app/files, "nginx" when
|
|
# an nginx proxy in front is the one serving /protected-files/, or "php" to
|
|
# stream deliberately. The dashboard's System panel shows which is in use.
|
|
# PROJECTSEND_FILE_DELIVERY=auto
|
|
|
|
# Optional: the virus scanner every upload is checked against, as
|
|
# tcp://host:3310 or unix:///path/to/clamd.sock. Naming it here makes
|
|
# scanning managed: it is used, it cannot be switched off from the settings
|
|
# screen, and the address does not appear there. Leave it unset to
|
|
# configure scanning in Settings instead, which is the ordinary way.
|
|
# PROJECTSEND_SCANNER_ADDRESS=tcp://clamav:3310
|
|
|
|
# Optional: uid/gid the app/web containers' internal user runs as, so the
|
|
# bind-mounted repo needs no permission fixes. Defaults to 1000; override
|
|
# if your host user's `id -u`/`id -g` differ.
|
|
# WWWUSER=1000
|
|
# WWWGROUP=1000
|
|
|
|
# Optional: create the first administrator unattended on container start.
|
|
# Leave unset to use the first-run setup screen instead.
|
|
# ADMIN_NAME="Administrator"
|
|
# ADMIN_EMAIL=admin@example.com
|
|
# ADMIN_PASSWORD=
|
|
APP_ENV=local
|
|
APP_KEY=
|
|
APP_DEBUG=true
|
|
APP_TIMEZONE=UTC
|
|
APP_URL=http://localhost
|
|
|
|
# Required whenever a proxy/load balancer sits in front of this app (an
|
|
# ALB, Cloudflare, a hosted ingress) — otherwise every request looks like
|
|
# it comes from the proxy, collapsing per-IP rate limits and the download
|
|
# IP log. Comma-separated addresses/CIDRs, or "*" to trust any proxy
|
|
# (only safe when nothing but the proxy can reach the app).
|
|
# TRUSTED_PROXIES=
|
|
|
|
APP_LOCALE=en
|
|
APP_FALLBACK_LOCALE=en
|
|
APP_FAKER_LOCALE=en_US
|
|
|
|
APP_MAINTENANCE_DRIVER=file
|
|
# APP_MAINTENANCE_STORE=database
|
|
|
|
PHP_CLI_SERVER_WORKERS=4
|
|
|
|
BCRYPT_ROUNDS=12
|
|
|
|
LOG_CHANNEL=stack
|
|
LOG_STACK=single
|
|
LOG_DEPRECATIONS_CHANNEL=null
|
|
LOG_LEVEL=debug
|
|
|
|
DB_CONNECTION=mysql
|
|
DB_HOST=db
|
|
DB_PORT=3306
|
|
DB_DATABASE=projectsend
|
|
DB_USERNAME=projectsend
|
|
DB_PASSWORD=secret
|
|
|
|
SESSION_DRIVER=redis
|
|
SESSION_LIFETIME=120
|
|
SESSION_ENCRYPT=false
|
|
SESSION_PATH=/
|
|
SESSION_DOMAIN=null
|
|
|
|
BROADCAST_CONNECTION=log
|
|
FILESYSTEM_DISK=local
|
|
|
|
# Set this only if your web server and PHP-FPM run as different system
|
|
# users — common on cPanel/Plesk shared hosting. Uploaded files are
|
|
# written 0600 in 0700 directories, which nginx cannot read, and since
|
|
# nginx is what actually streams a download (PHP authorizes, then hands
|
|
# it the path) every download fails while the rest of the site works.
|
|
# Relaxes those to 0644/0755, which every account on the machine can
|
|
# read — leave it off if your web server and PHP are the same user.
|
|
# FILES_WEB_SERVER_READABLE=true
|
|
QUEUE_CONNECTION=redis
|
|
|
|
CACHE_STORE=redis
|
|
CACHE_PREFIX=
|
|
|
|
MEMCACHED_HOST=127.0.0.1
|
|
|
|
REDIS_CLIENT=phpredis
|
|
REDIS_HOST=redis
|
|
REDIS_PASSWORD=null
|
|
REDIS_PORT=6379
|
|
|
|
MAIL_MAILER=smtp
|
|
MAIL_HOST=mailpit
|
|
MAIL_PORT=1025
|
|
MAIL_USERNAME=null
|
|
MAIL_PASSWORD=null
|
|
MAIL_ENCRYPTION=null
|
|
MAIL_FROM_ADDRESS="hello@example.com"
|
|
MAIL_FROM_NAME="${APP_NAME}"
|
|
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
AWS_DEFAULT_REGION=us-east-1
|
|
AWS_BUCKET=
|
|
AWS_USE_PATH_STYLE_ENDPOINT=false
|
|
|