mirror of
https://github.com/makeplane/plane.git
synced 2026-07-10 04:25:24 +02:00
1acc69e816
* fix: remove hardcoded SECRET_KEY from community deployment manifests (GHSA-cmwv-pjmw-8483) Replace the publicly-known default SECRET_KEY and LIVE_SERVER_SECRET_KEY values in AIO and CLI community deployment manifests with a safe placeholder. - deployments/aio: variables.env now ships with placeholder values; start.sh auto-generates a random key on first boot (or on upgrade from the old insecure default) and persists it in plane.env across restarts - deployments/cli: variables.env ships with placeholder; docker-compose.yml fallbacks that referenced the publicly-known default are removed - apps/api/plane/settings/common.py: SECRET_KEY resolution now uses `or` so an empty env var falls back to get_random_secret_key() (not ""); adds a startup warning if the known insecure default or placeholder is detected Closes WEB-7805 Co-authored-by: Plane AI <noreply@plane.so> * fix: use logger.critical instead of print for insecure SECRET_KEY warning Address code review feedback — replace module-level print() with _logger.critical() and move _logger definition before the SECRET_KEY block to avoid duplicate assignment. Also removes the now-unused `import sys`. Co-authored-by: Plane AI <noreply@plane.so> --------- Co-authored-by: Plane AI <noreply@plane.so>
99 lines
2.6 KiB
Bash
99 lines
2.6 KiB
Bash
APP_DOMAIN=localhost
|
|
APP_RELEASE=stable
|
|
|
|
WEB_REPLICAS=1
|
|
SPACE_REPLICAS=1
|
|
ADMIN_REPLICAS=1
|
|
API_REPLICAS=1
|
|
WORKER_REPLICAS=1
|
|
BEAT_WORKER_REPLICAS=1
|
|
LIVE_REPLICAS=1
|
|
|
|
LISTEN_HTTP_PORT=80
|
|
LISTEN_HTTPS_PORT=443
|
|
|
|
WEB_URL=http://${APP_DOMAIN}
|
|
DEBUG=0
|
|
CORS_ALLOWED_ORIGINS=http://${APP_DOMAIN}
|
|
API_BASE_URL=http://api:8000
|
|
|
|
#DB SETTINGS
|
|
PGHOST=plane-db
|
|
PGDATABASE=plane
|
|
POSTGRES_USER=plane
|
|
POSTGRES_PASSWORD=plane
|
|
POSTGRES_DB=plane
|
|
POSTGRES_PORT=5432
|
|
PGDATA=/var/lib/postgresql/data
|
|
DATABASE_URL=
|
|
|
|
# REDIS SETTINGS
|
|
REDIS_HOST=plane-redis
|
|
REDIS_PORT=6379
|
|
REDIS_URL=
|
|
|
|
# RabbitMQ Settings
|
|
RABBITMQ_HOST=plane-mq
|
|
RABBITMQ_PORT=5672
|
|
RABBITMQ_USER=plane
|
|
RABBITMQ_PASSWORD=plane
|
|
RABBITMQ_VHOST=plane
|
|
AMQP_URL=
|
|
|
|
# If SSL Cert to be generated, set CERT_EMAIl="email <EMAIL_ADDRESS>"
|
|
CERT_ACME_CA=https://acme-v02.api.letsencrypt.org/directory
|
|
TRUSTED_PROXIES=0.0.0.0/0
|
|
SITE_ADDRESS=:80
|
|
CERT_EMAIL=
|
|
|
|
|
|
|
|
# For DNS Challenge based certificate generation, set the CERT_ACME_DNS, CERT_EMAIL
|
|
# CERT_ACME_DNS="acme_dns <CERT_DNS_PROVIDER> <CERT_DNS_PROVIDER_API_KEY>"
|
|
CERT_ACME_DNS=
|
|
|
|
|
|
# Secret Key — change this before deploying to production.
|
|
# Generate a secure value with: python3 -c "from django.utils.crypto import get_random_secret_key; print(get_random_secret_key())"
|
|
# or: openssl rand -hex 32
|
|
SECRET_KEY=change-this-key-on-deployment
|
|
|
|
# DATA STORE SETTINGS
|
|
USE_MINIO=1
|
|
AWS_REGION=
|
|
AWS_ACCESS_KEY_ID=access-key
|
|
AWS_SECRET_ACCESS_KEY=secret-key
|
|
AWS_S3_ENDPOINT_URL=http://plane-minio:9000
|
|
AWS_S3_BUCKET_NAME=uploads
|
|
FILE_SIZE_LIMIT=5242880
|
|
|
|
# Gunicorn Workers
|
|
GUNICORN_WORKERS=1
|
|
|
|
# UNCOMMENT `DOCKER_PLATFORM` IF YOU ARE ON `ARM64` AND DOCKER IMAGE IS NOT AVAILABLE FOR RESPECTIVE `APP_RELEASE`
|
|
# DOCKER_PLATFORM=linux/amd64
|
|
|
|
# Force HTTPS for handling SSL Termination
|
|
MINIO_ENDPOINT_SSL=0
|
|
|
|
# API key rate limit
|
|
API_KEY_RATE_LIMIT=60/minute
|
|
|
|
# Per-IP throttle for anonymous authentication endpoints (magic-link
|
|
# generate / sign-in / sign-up, email sign-in). DRF format: "<n>/<period>"
|
|
# where period is second/minute/hour/day.
|
|
AUTHENTICATION_RATE_LIMIT=10/minute
|
|
|
|
# Live server environment variables — change this before deploying to production.
|
|
# Generate a secure value with: openssl rand -hex 32
|
|
LIVE_SERVER_SECRET_KEY=change-this-key-on-deployment
|
|
|
|
# Webhook IP allowlist — comma-separated IPs or CIDR ranges allowed as webhook targets
|
|
# even if they resolve to private networks (e.g. "10.0.0.0/8,192.168.1.0/24,172.16.0.5")
|
|
WEBHOOK_ALLOWED_IPS=
|
|
|
|
# Webhook hostname allowlist — comma-separated hostnames that bypass the private-IP
|
|
# SSRF check. Useful for trusted internal services whose container/service IPs are
|
|
# dynamic (e.g. "silo,silo.namespace.svc.cluster.local")
|
|
WEBHOOK_ALLOWED_HOSTS=
|