48c9a408f6
The docs promised that writes.test.js pins every write. They now say what it covers: node:fs writes and shell commands, on the paths it exercises. They also name what keeps the second layer up: the Defenseurs content is group-writable, and only the owning group (defenseur, gid 1001, not the gid 1000 of node and ubuntu) keeps the container out, so a chgrp ubuntu would drop that layer silently. Fixes #36 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.7 KiB
Text
29 lines
1.7 KiB
Text
PORT=3001
|
|
# HEALTH_TOKEN is read at runtime only (process.env at startup).
|
|
# On Coolify: MUST be is_runtime=true, is_buildtime=false.
|
|
# Buildtime ARG leaks the secret in clear in application_deployment_queues.logs.
|
|
HEALTH_TOKEN=change-me-to-a-strong-secret
|
|
LOGTO_HEALTH_URL=https://auth.lacompagniemaximus.com/oidc/.well-known/openid-configuration
|
|
# Directory read by GET /reports/scans and GET /defenseurs/findings. On Coolify
|
|
# it is its own read-only mount (/home/defenseur/defenseurs/reports ->
|
|
# /data/defenseurs/reports:ro), nested inside the read-only /data/defenseurs
|
|
# mount that holds status.json.
|
|
REPORTS_DIR=/data/defenseurs/reports
|
|
|
|
# --- Workstation snapshots (POST /hosts/<id>, GET /hosts) --------------------
|
|
# Directory the API WRITES workstation snapshots into, one <id>.json per host.
|
|
# Unlike the two /data/defenseurs mounts (read-only `:ro`; content owned by
|
|
# defenseur:defenseur, uid/gid 1001, group-writable but not by gid 1000), this
|
|
# one must be writable by uid 1000 (the `node` user the container runs as) or
|
|
# every ingest answers 500.
|
|
HOSTS_DIR=/data/hosts
|
|
# Comma-separated allowlist of host ids. Each entry must match
|
|
# ^[a-z0-9][a-z0-9-]{0,31}$ — anything else is logged and dropped at startup.
|
|
HOSTS_ALLOWED_IDS=thinkpad
|
|
# Bearer token for POST /hosts/<id>. Separate from HEALTH_TOKEN on purpose: a
|
|
# workstation agent should be able to write its own snapshot without gaining
|
|
# read access to the Defenseurs reports. Same Coolify rule as HEALTH_TOKEN —
|
|
# is_runtime=true, is_buildtime=false. Unset -> POST /hosts/<id> answers 503.
|
|
HOSTS_INGEST_TOKEN=change-me-to-a-strong-secret
|
|
# Age (seconds) past which GET /hosts reports a host as offline. Default 900.
|
|
HOSTS_STALE_SECONDS=900
|