-
Notifications
You must be signed in to change notification settings - Fork 9
Expand file tree
/
Copy path.env.example
More file actions
143 lines (135 loc) · 6.71 KB
/
Copy path.env.example
File metadata and controls
143 lines (135 loc) · 6.71 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
# -----------------------------------------------------------------------------
# arsnova.eu - Lokale Umgebungsvariablen
# Kopiere diese Datei zu .env und passe die Werte bei Bedarf an.
# -----------------------------------------------------------------------------
# -----------------------------------------------------------------------------
# Credentials / Secrets (zuerst)
# -----------------------------------------------------------------------------
POSTGRES_USER=arsnova_user
POSTGRES_PASSWORD=secretpassword
POSTGRES_DB=arsnova_v3_dev
DATABASE_URL="postgresql://arsnova_user:secretpassword@localhost:5432/arsnova_v3_dev?schema=public"
REDIS_URL="redis://localhost:6379"
# Für npm run start:prod (NODE_ENV=production) mindestens 32 UTF-8-Bytes.
JWT_SECRET="super-secret-local-dev-key-min-32-bytes"
ADMIN_SECRET="set-a-strong-admin-secret"
ADMIN_DIAGNOSTIC_SECRET="set-a-different-strong-diagnostic-secret"
# Optional getrennt rotierbar; ohne Wert wird JWT_SECRET mit Domain-Separation genutzt.
CSP_REPORT_HASH_SECRET="set-a-random-csp-report-hash-secret"
# -----------------------------------------------------------------------------
# Laufzeit / Netzwerk (lokal)
# -----------------------------------------------------------------------------
NODE_ENV=development
PORT=3000
HOST=0.0.0.0
WS_PORT=3001
# Globale, Shared-NAT-taugliche tRPC-WebSocket-Grenzen (keine IP-Buckets):
WS_HOST=0.0.0.0
TRPC_WS_MAX_CONNECTIONS=1200
TRPC_WS_MAX_CONNECTIONS_PER_SESSION=1100
TRPC_WS_MAX_CONNECTIONS_PER_PARTICIPANT=2
TRPC_WS_MAX_UPGRADES_PER_MINUTE=3000
TRPC_WS_MAX_MESSAGES_PER_10_SECONDS=120
TRPC_WS_MAX_MESSAGES_GLOBAL_PER_10_SECONDS=30000
YJS_WS_PORT=3002
# Großzügige, nicht IP-basierte Relay-Grenzen (statische Code-Maxima bleiben bindend):
YJS_WS_MAX_CONNECTIONS=1000
YJS_WS_MAX_CONNECTIONS_PER_ROOM=200
YJS_WS_MAX_UPGRADES_PER_MINUTE=3000
YJS_WS_MAX_UPGRADES_PER_ROOM_PER_MINUTE=600
YJS_WS_MAX_PAYLOAD_BYTES=16777216
YJS_WS_MAX_MESSAGES_PER_10_SECONDS=600
YJS_WS_MAX_BYTES_PER_10_SECONDS=33554432
YJS_WS_MAX_MESSAGES_PER_ROOM_PER_10_SECONDS=6000
YJS_WS_MAX_BYTES_PER_ROOM_PER_10_SECONDS=268435456
YJS_WS_MAX_MESSAGES_GLOBAL_PER_10_SECONDS=30000
YJS_WS_MAX_BYTES_GLOBAL_PER_10_SECONDS=1073741824
YJS_WS_MAX_DOCUMENT_BYTES_PER_ROOM=15728640
YJS_WS_MAX_DOCUMENT_BYTES_GLOBAL=268435456
YJS_WS_MAX_AWARENESS_STATE_BYTES=4096
YJS_WS_MAX_OUTBOUND_BYTES_PER_10_SECONDS=33554432
YJS_WS_MAX_OUTBOUND_BYTES_PER_ROOM_PER_10_SECONDS=268435456
YJS_WS_MAX_OUTBOUND_BYTES_GLOBAL_PER_10_SECONDS=1073741824
# In Dev optional; bei lokalem Reverse-Proxy ggf. auf 1 setzen:
# TRUST_PROXY_HOPS=1
# -----------------------------------------------------------------------------
# Admin-Konfiguration
# -----------------------------------------------------------------------------
ADMIN_SESSION_TTL_SECONDS=28800
ADMIN_LEGAL_HOLD_DEFAULT_DAYS=30
# -----------------------------------------------------------------------------
# Rate-Limiting (Dev-Defaults, Story 0.5 / Epic 10)
# -----------------------------------------------------------------------------
# Nur ungültige Codes; gültige Joins/Rejoins umgehen diese Budgets vollständig.
# Anonymous Client-ID wird ausschließlich gehasht als Redis-Key verwendet.
RATE_LIMIT_SESSION_CODE_WINDOW_SECONDS=300
RATE_LIMIT_SESSION_CODE_CLIENT_FAILURES_PER_WINDOW=20
RATE_LIMIT_SESSION_CODE_CODE_SOFT_CAP_PER_WINDOW=600
RATE_LIMIT_SESSION_CODE_GLOBAL_SOFT_CAP_PER_WINDOW=5000
RATE_LIMIT_SESSION_CODE_DELAY_BASE_MS=100
RATE_LIMIT_SESSION_CODE_DELAY_MAX_MS=1500
RATE_LIMIT_SESSION_CODE_MAX_CONCURRENT_DELAYS=100
# Pre-Auth-Permits vor jedem Secret-Vergleich; kein Admin-IP-Lockout.
RATE_LIMIT_ADMIN_LOGIN_WINDOW_SECONDS=60
RATE_LIMIT_ADMIN_LOGIN_GLOBAL_ATTEMPTS_PER_WINDOW=60
RATE_LIMIT_ADMIN_LOGIN_DELAY_BASE_MS=100
RATE_LIMIT_ADMIN_LOGIN_DELAY_MAX_MS=2000
RATE_LIMIT_ADMIN_LOGIN_MAX_CONCURRENT_DELAYS=25
RATE_LIMIT_VOTE_REQUESTS_PER_SECOND=1
RATE_LIMIT_SESSION_CREATE_PER_HOUR=10
RATE_LIMIT_SESSION_CREATE_GLOBAL_PER_HOUR=120
RATE_LIMIT_QUIZ_UPLOAD_ATTEMPT_PER_IP_PER_HOUR=600
RATE_LIMIT_QUIZ_UPLOAD_ATTEMPT_GLOBAL_PER_HOUR=1200
RATE_LIMIT_QUIZ_UPLOAD_PER_IP_PER_HOUR=300
RATE_LIMIT_QUIZ_UPLOAD_GLOBAL_PER_HOUR=600
RATE_LIMIT_QUIZ_UPLOAD_GLOBAL_BYTES_PER_HOUR=67108864
RATE_LIMIT_QUIZ_UPLOAD_GLOBAL_COMPLEXITY_PER_HOUR=100000
RATE_LIMIT_QUICK_FEEDBACK_STANDALONE_PER_IP_PER_HOUR=600
RATE_LIMIT_QUICK_FEEDBACK_STANDALONE_GLOBAL_PER_HOUR=3000
RATE_LIMIT_QUICK_FEEDBACK_SESSION_PER_MINUTE=120
# Öffentlicher /csp-report-Ingest; Werte sind nur bis zu den statischen Maxima
# 6000 global / 120 je trusted req.ip konfigurierbar.
CSP_REPORT_GLOBAL_PER_MINUTE=6000
CSP_REPORT_PER_IP_PER_MINUTE=120
CSP_REPORT_FALLBACK_GLOBAL_PER_MINUTE=6000
# Eine feste Generation mit max. 256 gehashten Dimensionen; max. 7 Tage.
CSP_REPORT_RETENTION_SECONDS=604800
# Rollback-sicherer W2.4b-Schalter. Default bleibt aus; erst nach Endpoint-Smoke
# explizit aktivieren. Setzt ausschließlich Report-Only auf HTML-Dokumente.
CSP_REPORT_ONLY_ENABLED=false
# W3.4: Yjs-Share-Token-HMAC (≥32 Bytes) und Legacy-UUID-Grace-Cutoff.
# Produktion: YJS_SHARE_TOKEN_SECRET oder JWT_SECRET (≥32 Bytes) Pflicht.
# YJS_SHARE_TOKEN_SECRET=
# YJS_SHARE_LEGACY_UUID_CUTOFF_AT=2026-10-01T00:00:00.000Z
# RATE_LIMIT_YJS_SHARE_REGISTER_PER_IP_PER_HOUR=30
# RATE_LIMIT_YJS_SHARE_REGISTER_GLOBAL_PER_HOUR=200
# RATE_LIMIT_YJS_SHARE_ROTATE_PER_IP_PER_HOUR=60
# RATE_LIMIT_YJS_SHARE_ROTATE_GLOBAL_PER_HOUR=500
# RATE_LIMIT_YJS_SHARE_VALIDATE_PER_IP_PER_MINUTE=2000
# RATE_LIMIT_YJS_SHARE_VALIDATE_GLOBAL_PER_MINUTE=10000
# W3.3: Nach diesem UTC-Zeitpunkt kein Legacy-accessProof-Upgrade mehr auf
# bereits gebundenen Quizkopien (bindQuizHistoryScope). Historien-Endpunkte
# lehnen Legacy nach Bind unabhängig vom Cutoff ab.
# QUIZ_HISTORY_LEGACY_PROOF_CUTOFF_AT=2026-09-01T00:00:00.000Z
# Optional: Localhost-Bypass erzwingen (ohne Override in Nicht-Prod bereits aktiv)
# RATE_LIMIT_SESSION_CREATE_BYPASS_LOCALHOST=true
RATE_LIMIT_MOTD_GET_CURRENT_PER_MINUTE=600
# RATE_LIMIT_MOTD_GET_CURRENT_BYPASS_LOCALHOST=true
RATE_LIMIT_MOTD_LIST_ARCHIVE_PER_MINUTE=60
RATE_LIMIT_MOTD_RECORD_INTERACTION_PER_MINUTE=40
# Story 1.14b: optionale spaCy-Glättung (umgesetzt). Default aus.
# Docker-App-Container: npm run docker:up:nlp und Socket /run/spacy/nlp.sock (Volume).
# Host-npm auf macOS sieht das Docker-Volume nicht. Helfer:
# npm run spacy:macos-dev
# (Sidecar /tmp/arsnova-nlp.sock, start:prod, UI http://localhost:4200/de/ — kein ng serve)
# Manuell:
# NLP_ENABLED=true
# NLP_SOCKET_PATH=/tmp/arsnova-nlp.sock
# NLP_SOCKET_PATH=/tmp/arsnova-nlp.sock python docker/spacy/server.py
# Kein öffentlicher Port — Unix-Socket analog zum PDF-Worker.
NLP_ENABLED=false
NLP_SOCKET_PATH=/run/spacy/nlp.sock
NLP_TIMEOUT_MS=5000
# Redis-TTL für Text- und Snapshot-Cache (60–28800). Transiente Sidecar-Fehler
# und NLP_DISABLED werden nicht gecacht.
NLP_CACHE_TTL_SECONDS=1800