ske087
46602f1933
Remove dead code identified in docs/SANITIZATION-REVIEW.md:
- app/blueprints/content_old.py and app/blueprints/playlist.py
- app/models/group.py, app/utils/nginx_config_reader.py
- orphaned templates (content_list, edit_content, upload_content,
player_page) and the related group/Template references
Result: 6 blueprints, 82 routes, no dead modules or orphan templates.
Add files that deploy.sh and docker-entrypoint.sh already require but
which were never tracked:
- https_manager.py (referenced by deploy.sh, migrate_network.sh,
docker-entrypoint.sh)
- Caddyfile.example (seeded by deploy.sh; its absence aborts deploy)
Relocate generated Graphify artifacts from graphify-out/ to
docs/graphify-out/ (110 files, no content change) and archive the
superseded docs under docs/.
Ignore hygiene:
- ignore ad-hoc .env backups (.env.bak*) — they contain live secrets
- keep the pre-sanitization snapshots (docs/legacy code/,
docs/old_code_documentation/) on disk but out of the repo
Fix .env.example: drop a duplicated config block, genericize the
hardcoded host IP, and document HOSTNAME_INTERNAL.
90 lines
3.3 KiB
Bash
90 lines
3.3 KiB
Bash
# DigiServer v2 Production Environment Configuration
|
|
# Copy to .env and update with your production values
|
|
# IMPORTANT: Never commit this file to git
|
|
|
|
# Server Configuration
|
|
# ---------------------------------------------------------------------------
|
|
# Deploy-time TLS bootstrap. Copy this file to `.env` and set these two before
|
|
# `docker compose up`. Both must be present for HTTPS to be configured at
|
|
# startup; if either is missing the app stays on the plain-HTTP fallback and you
|
|
# can enable HTTPS later from Admin → HTTPS Configuration (no restart needed).
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Hostname shown in the UI and used in the Caddy site block.
|
|
HOSTNAME_INTERNAL=digiserver
|
|
|
|
# The host's LAN IP as reachable by the players/browsers.
|
|
# Replace 192.168.1.100 with THIS server's actual LAN IP. It is used for the
|
|
# Caddy site blocks and the certificate, so a wrong value breaks HTTPS.
|
|
# Find it with: ip -4 route get 1.1.1.1 | grep -oP 'src \K[\d.]+'
|
|
HOST_IP=192.168.1.100
|
|
|
|
# Public domain for Let's Encrypt. LEAVE EMPTY for an intranet/internal name
|
|
# (e.g. "digiserver" or "signage.corp.local") — a non-public name cannot pass an
|
|
# ACME challenge, so an empty DOMAIN selects Caddy's internal CA instead.
|
|
DOMAIN=
|
|
|
|
# Email for ACME/Let's Encrypt notifications (unused by the internal CA).
|
|
SSL_EMAIL=admin@example.com
|
|
|
|
# Published ports. Caddy listens on 80/443 inside the container; these control
|
|
# which host ports they are mapped to. Port 80 is always answered — the site
|
|
# responds whether clients use the IP or the hostname.
|
|
HTTP_PORT=80
|
|
HTTPS_PORT=443
|
|
|
|
# "true" → also serve plain HTTP alongside HTTPS. Required for players whose
|
|
# trust store lacks the internal CA (i.e. verify_ssl is not disabled).
|
|
# "false" → serve TLS only and redirect HTTP to https://<host>:<HTTPS_PORT>.
|
|
HTTPS_HTTP_FALLBACK=true
|
|
|
|
# After configuring HTTPS, probe it and automatically fall back to plain HTTP if
|
|
# it does not come up — so a bad certificate can never make the site unreachable.
|
|
# Set "false" to trust the configuration without probing.
|
|
HTTPS_VERIFY=true
|
|
|
|
# Flask Configuration
|
|
FLASK_ENV=production
|
|
FLASK_APP=app.app:create_app
|
|
|
|
# Security - MUST BE SET IN PRODUCTION
|
|
# Generate with: python -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
SECRET_KEY=change-me-to-a-strong-random-secret-key-at-least-32-characters
|
|
|
|
# Admin User Configuration
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD=change-me-to-a-strong-password
|
|
ADMIN_EMAIL=admin@your-domain.com
|
|
|
|
# Database Configuration (optional - defaults to SQLite)
|
|
# For PostgreSQL: postgresql://user:pass@host:5432/database
|
|
# For SQLite: sqlite:////data/instance/dashboard.db
|
|
# DATABASE_URL=
|
|
|
|
PREFERRED_URL_SCHEME=https
|
|
|
|
# Logging
|
|
LOG_LEVEL=INFO
|
|
|
|
# Features (optional)
|
|
ENABLE_LIBREOFFICE=true
|
|
MAX_UPLOAD_SIZE=500000000 # 500MB
|
|
|
|
# Cache Configuration (optional)
|
|
CACHE_TYPE=simple
|
|
CACHE_DEFAULT_TIMEOUT=300
|
|
|
|
# Session Configuration
|
|
SESSION_COOKIE_SECURE=true
|
|
SESSION_COOKIE_HTTPONLY=true
|
|
SESSION_COOKIE_SAMESITE=Lax
|
|
|
|
# Proxy Configuration (configured in app.py)
|
|
# IMPORTANT: Set this to your actual network range or specific proxy IP
|
|
# Examples:
|
|
# - 192.168.0.0/24 (local network with /24 subnet)
|
|
# - 10.0.0.0/8 (AWS or similar cloud)
|
|
# - 172.16.0.0/12 (Docker networks)
|
|
# For multiple IPs: 192.168.0.121,10.0.1.50
|
|
TRUSTED_PROXIES=192.168.0.0/24
|