mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
8e1b9826cf
* fix(api): add tiered rate limiting to prevent polling lockouts Replace the single global rate limiter (100 req/min/IP) with a tiered system that separates high-frequency polling endpoints from standard API traffic: - Polling tier (300/min): /stats, /system/stats, /stacks/statuses, /metrics/historical, /health, /meta, /auth/status, /auth/sso/providers, /license. Exempt from the global limiter but governed by their own safety net to prevent resource exhaustion. - Standard tier (200/min): All other endpoints, raised from 100. - Webhook tier (500/min): POST /webhooks/:id/trigger, dedicated limiter for CI/CD platforms sharing datacenter IPs. - Auth tier: Unchanged (5-10 attempts / 15 min). Enterprise adaptations: - Authenticated requests keyed by user session (JWT sub/username) instead of IP, preventing shared NAT/VPN environments from pooling budgets. - Internal node-to-node traffic (node_proxy tokens) bypasses all rate limiters entirely. Includes comprehensive stress tests (21 cases) validating tier separation, node proxy bypass, and per-user keying. * chore(deps): bump axios to 1.15.0 to fix SSRF vulnerability Addresses GHSA-3p68-rc4w-qgx5 (NO_PROXY hostname normalization bypass).
69 lines
2.1 KiB
Bash
69 lines
2.1 KiB
Bash
# Sencho Configuration
|
|
# Copy this file to .env and update the values for production
|
|
|
|
# JWT secret - generate a secure random string for production
|
|
JWT_SECRET=your-secure-jwt-secret-here
|
|
|
|
# Directory containing docker-compose files
|
|
COMPOSE_DIR=/path/to/your/compose/files
|
|
|
|
# HTTP server port (default: 3000)
|
|
PORT=3000
|
|
|
|
# Database and state directory inside the container (default: /app/data)
|
|
DATA_DIR=/app/data
|
|
|
|
# Node environment (set automatically in Docker image; only change for local dev)
|
|
NODE_ENV=production
|
|
|
|
# Frontend URL for CORS in production (leave empty for same-origin setups)
|
|
FRONTEND_URL=
|
|
|
|
# Global API rate limit (requests per minute per user session, production only)
|
|
# Authenticated requests are keyed by user ID; unauthenticated by IP.
|
|
# Internal node-to-node traffic (node_proxy tokens) bypasses this limit entirely.
|
|
API_RATE_LIMIT=200
|
|
|
|
# Polling endpoint rate limit (requests per minute, production only)
|
|
# Applies to dashboard/status polling endpoints that are exempt from the global limit.
|
|
# Increase for environments with many concurrent browser sessions behind shared NAT.
|
|
API_POLLING_RATE_LIMIT=300
|
|
|
|
# ─── SSO / LDAP Configuration (Admiral) ───────────────────────────
|
|
|
|
# LDAP / Active Directory
|
|
SSO_LDAP_ENABLED=false
|
|
SSO_LDAP_URL=ldap://ldap.example.com:389
|
|
SSO_LDAP_BIND_DN=cn=readonly,dc=example,dc=com
|
|
SSO_LDAP_BIND_PASSWORD=
|
|
SSO_LDAP_SEARCH_BASE=ou=users,dc=example,dc=com
|
|
SSO_LDAP_SEARCH_FILTER=(uid={{username}})
|
|
SSO_LDAP_ADMIN_GROUP_DN=
|
|
SSO_LDAP_DEFAULT_ROLE=viewer
|
|
SSO_LDAP_DISPLAY_NAME=LDAP
|
|
SSO_LDAP_TLS_REJECT_UNAUTHORIZED=true
|
|
|
|
# Google OIDC
|
|
SSO_OIDC_GOOGLE_ENABLED=false
|
|
SSO_OIDC_GOOGLE_CLIENT_ID=
|
|
SSO_OIDC_GOOGLE_CLIENT_SECRET=
|
|
|
|
# GitHub OAuth
|
|
SSO_OIDC_GITHUB_ENABLED=false
|
|
SSO_OIDC_GITHUB_CLIENT_ID=
|
|
SSO_OIDC_GITHUB_CLIENT_SECRET=
|
|
|
|
# Okta OIDC
|
|
SSO_OIDC_OKTA_ENABLED=false
|
|
SSO_OIDC_OKTA_ISSUER_URL=
|
|
SSO_OIDC_OKTA_CLIENT_ID=
|
|
SSO_OIDC_OKTA_CLIENT_SECRET=
|
|
|
|
# Role mapping (shared across OIDC providers)
|
|
SSO_OIDC_ADMIN_CLAIM=groups
|
|
SSO_OIDC_ADMIN_CLAIM_VALUE=sencho-admins
|
|
SSO_DEFAULT_ROLE=viewer
|
|
|
|
# External base URL for OAuth callback URLs (required behind reverse proxy)
|
|
SSO_CALLBACK_URL=
|