Init

2026-07-17 15:57:36 +03:00
commit e4240a7be5
72 changed files with 6227 additions and 0 deletions
@@ -0,0 +1,47 @@
+# Application
+APP_NAME=Wrapped
+APP_ENV=development
+APP_SECRET_KEY=change-me-to-a-long-random-string
+APP_BASE_URL=http://localhost:8000
+LOG_LEVEL=INFO
+# Swagger UI (/docs), ReDoc, openapi.json — keep true for local dev
+DOCS_ENABLED=true
+
+# Admin (change in production)
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD=38dmWjE1p
+
+# Postgres
+DATABASE_URL=postgresql+asyncpg://wrapped:wrapped@postgres:5432/wrapped
+
+# MinIO / S3
+S3_ENDPOINT_URL=http://minio:9000
+S3_ACCESS_KEY=wrappedminio
+S3_SECRET_KEY=wrappedminio123
+S3_BUCKET=wrapped
+S3_REGION=us-east-1
+S3_USE_SSL=false
+S3_CREATE_BUCKET=true
+
+# Optional CAPTCHA secrets (site keys can also be set in admin UI)
+TURNSTILE_SECRET_KEY=
+HCAPTCHA_SECRET_KEY=
+
+# Client IP / audit: trust these peers for X-Forwarded-For / X-Real-IP.
+# Use * only when the app is not publicly reachable (e.g. behind ClusterIP + Ingress).
+# Default covers loopback + RFC1918 (Docker Compose nginx, k8s CNI).
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
+# Proxies allowed to set X-Forwarded-For / X-Real-IP (audit client IP).
+# Use * behind Ingress when only the proxy can reach the app.
+# Default covers loopback, RFC1918, and Docker Desktop gateway.
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,192.168.65.0/24
+
+# Client IP / audit: peers allowed to set X-Forwarded-For, X-Real-IP, CF-Connecting-IP.
+# Default = loopback + RFC1918 (Docker Desktop gateway, k8s pod CIDRs, local proxies).
+# In Kubernetes behind Ingress use * (only the ingress can reach the Service).
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+
+# Client IP / audit: peers allowed to set X-Forwarded-For, X-Real-IP, CF-Connecting-IP.
+# Use * behind a dedicated ingress (recommended in k8s). Default = loopback + RFC1918.
+TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16