Agent Zero
7fbbe420bd
Check Cross-Plugin Imports / check (push) Has been cancelled
CRITICAL: - Fix SQL injection in prestart.sh (parameterized query) - Fix secret key validation (always validate, not just production) - Fix workspace model partial index bug (func.text -> text) - Fix HealthResponse schema (add checks field) - Fix Tenant import in permissions.py (NameError on every auth request) - Fix README tech stack (React instead of Alpine.js) - Delete broken test_cross_tenant_security_v2.py - Add fail-closed RLS migration 0084 (48 tenant tables) HIGH: - Add GeneralRateLimitMiddleware for all API routes - Add file type blocklist for DMS and attachment uploads - Fix guest auth: Pydantic schema, tenant_slug required, CSRF bypass - Fix CSRF bypass path matching (in -> endswith) - Add worker healthcheck in docker-compose.yml - Add ARQ max_tries=3 for job retries - Fix 28 bare pass in mail services (-> logger.debug) - Fix print() -> logger in main.py and ai_assistant - Fix duplicate email handling (catch IntegrityError -> 409) - Add session revocation (invalidate_all_user_sessions) - Add resource limits to all containers - Fix CORS default (localhost -> production domain) - Fix SameSite=Lax -> Strict - Fix Redis password visibility in healthcheck - Fix npm vulnerabilities (19 -> 9) - Fix Sidebar OOM (wildcard lucide import -> curated ICON_MAP) MEDIUM: - Localize ErrorBoundary to German - Wire Mail.tsx save/delete filter to API - Document system_notif plugin (no routes needed) - Fix datetime.utcnow() -> datetime.now(UTC) - Pin litellm version (>=1.0,<2.0) - Move CSRF token from sessionStorage to in-memory - Fix restore_backup error handling and transaction - Fix Dms.tsx useEffect cleanup - Add skip-to-content link for accessibility - Add selectinload imports to 3 services - Add .env.example missing variables - Fix AppShell/TopBar/Sidebar test mocks NEW TESTS: - test_guest_auth.py (6 tests) - test_user_service.py (8 tests) - test_backup_service.py (5 tests) NEW SCHEMAS: - saved_filter, saved_view, user_preference, workspace, entity_policy Tests: 22/22 PASSED
82 lines
2.1 KiB
Bash
82 lines
2.1 KiB
Bash
# LeoCRM v1.0 - Environment Variables Template
|
|
|
|
# === REQUIRED ===
|
|
DATABASE_URL=postgresql+asyncpg://leocrm:leocrm@localhost:5432/leocrm
|
|
REDIS_URL=redis://localhost:6379/0
|
|
|
|
# === REQUIRED for Docker/Production ===
|
|
# Migration DB URL (owner user, can bypass RLS for DDL)
|
|
MIGRATION_DATABASE_URL=postgresql+asyncpg://crm_migration:your_password@localhost:5432/crm_db
|
|
# Redis password (required in Docker)
|
|
REDIS_PASSWORD=your_redis_password
|
|
# Runtime DB password (set crm_runtime role password on startup)
|
|
RUNTIME_DB_PASSWORD=your_runtime_password
|
|
|
|
# === OPTIONAL (with defaults) ===
|
|
|
|
# Environment: development | production | testing
|
|
ENVIRONMENT=development
|
|
|
|
# Log level: DEBUG | INFO | WARNING | ERROR
|
|
LOG_LEVEL=INFO
|
|
|
|
# Database pool
|
|
DB_POOL_SIZE=10
|
|
DB_MAX_OVERFLOW=20
|
|
DB_ECHO=false
|
|
|
|
# Session settings
|
|
SESSION_TTL_SECONDS=28800
|
|
SESSION_COOKIE_NAME=leocrm_session
|
|
SESSION_COOKIE_SECURE=false
|
|
SESSION_COOKIE_SAMESITE=strict
|
|
SESSION_COOKIE_HTTPONLY=true
|
|
|
|
# Password hashing
|
|
BCRYPT_ROUNDS=12
|
|
PASSWORD_RESET_EXPIRY_HOURS=1
|
|
|
|
# CORS allowed origins (comma-separated, NO wildcards)
|
|
CORS_ORIGINS=http://localhost:5173,http://localhost:3000
|
|
|
|
# Secret Key (for signing, sessions — use a secure random string ≥32 chars in prod)
|
|
SECRET_KEY=change-me-in-production-use-a-secure-random-string
|
|
|
|
# Storage (file uploads, DMS)
|
|
STORAGE_PATH=/tmp
|
|
# Storage backend: local (default) or s3
|
|
STORAGE_BACKEND=local
|
|
# S3-compatible storage (when STORAGE_BACKEND=s3)
|
|
S3_ENDPOINT=
|
|
S3_BUCKET=
|
|
S3_ACCESS_KEY=
|
|
S3_SECRET_KEY=
|
|
S3_REGION=us-east-1
|
|
S3_SECURE=true
|
|
|
|
# SMTP / Email
|
|
SMTP_HOST=localhost
|
|
SMTP_PORT=587
|
|
SMTP_USERNAME=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM_EMAIL=noreply@leocrm.local
|
|
SMTP_USE_TLS=true
|
|
|
|
# Rate limiting
|
|
RATE_LIMIT_LOGIN_MAX=5
|
|
RATE_LIMIT_LOGIN_WINDOW=900
|
|
RATE_LIMIT_RESET_MAX=3
|
|
RATE_LIMIT_RESET_WINDOW=3600
|
|
RATE_LIMIT_RESET_CONFIRM_MAX=5
|
|
RATE_LIMIT_RESET_CONFIRM_WINDOW=3600
|
|
RATE_LIMIT_GENERAL_MAX=60
|
|
RATE_LIMIT_GENERAL_WINDOW=60
|
|
|
|
# === AI / Search ===
|
|
# Ollama Cloud API Key (für LiteLLM)
|
|
API_KEY_OLLAMA_CLOUD=
|
|
# Embedding Modell (default: ollama/nomic-embed-text)
|
|
SEARCH_EMBEDDING_MODEL=ollama/nomic-embed-text
|
|
# LLM Modell für Query Understanding (default: ollama/deepseek-v4)
|
|
SEARCH_LLM_MODEL=ollama/deepseek-v4
|