philipp/incus-backup-ui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security hardening

Browse Source
This commit is contained in:
Philipp
2026-05-21 14:09:08 +02:00
parent 3103aba972
commit 0046156e58
16 changed files with 205 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment.md
+7 -2
View File
@@ -15,11 +15,11 @@ Important `.env` values:
```env
PORT=3000
API_TOKEN="long-random-token"
API_TOKEN="long-random-token-at-least-32-characters"
ALLOWED_MANAGEMENT_IPS="management-server-ip"
```
If `ALLOWED_MANAGEMENT_IPS` is set, the agent only accepts requests from those comma-separated IP addresses.
`API_TOKEN` is required and must be at least 32 characters long. If `ALLOWED_MANAGEMENT_IPS` is set, the agent only accepts requests from those comma-separated IP addresses.
Install systemd service:
@@ -49,8 +49,13 @@ SESSION_SECRET="long-random-secret"
AUTH_USERNAME="admin"
AUTH_PASSWORD="initial-password"
DATABASE_PATH="./management.sqlite"
CORS_ORIGINS="https://backup.example.com"
SESSION_COOKIE_SECURE=true
ALLOW_INSECURE_AGENT_HTTP=false
```
`AUTH_PASSWORD` is required for the first start when the user database is empty. `CORS_ORIGINS` must list the frontend origins that are allowed to use cookie-authenticated API calls. Agent URLs must use `https://`; only set `ALLOW_INSECURE_AGENT_HTTP=true` for local development.
Reset an existing password:
```bash