mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
d0d153b768
- ARTEX_TRUSTED_PROXIES (comma-separated CIDRs, empty by default). When the TCP peer is listed, the login limit reads X-Forwarded-For from the right and keys on the first hop that is not a trusted proxy; otherwise the header is ignored. Without it every client behind a reverse proxy shares one bucket and an attacker can block the admin. Passed through by docker-compose.yml and listed in .env.example. - README: nginx example sends X-Forwarded-For; document the variable; the binary's default listen address is 127.0.0.1:8787. - reset-password.sh refuses passwords under 12 characters, counted in characters like the server.
20 lines
768 B
Bash
20 lines
768 B
Bash
# Docker deployment configuration (copy to .env)
|
|
# The image is built locally by `docker compose build`; there is no registry tag.
|
|
# Address the web UI is published on. 127.0.0.1 keeps it host-local; set 0.0.0.0
|
|
# to reach it from another machine or from Windows when ARTEX runs inside WSL.
|
|
ARTEX_BIND_ADDR=127.0.0.1
|
|
# Reverse proxies (comma-separated CIDRs) whose X-Forwarded-For the login rate
|
|
# limit trusts. Empty: the header is ignored. See "Reverse proxy deployment" in README.md.
|
|
ARTEX_TRUSTED_PROXIES=
|
|
POSTGRES_USER=artex
|
|
POSTGRES_PASSWORD=change-me-please
|
|
POSTGRES_DB=artex
|
|
|
|
# LLM (fill one or both; you can also leave empty and configure in the UI)
|
|
ANTHROPIC_API_KEY=
|
|
OPENAI_API_KEY=
|
|
ARTEX_LLM_PROVIDER=
|
|
ARTEX_LLM_MODEL=
|
|
ARTEX_LLM_BASE_URL=
|
|
ARTEX_LLM_PROXY=
|