jacobh2
7fb86f5524
- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. - Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs 0750 1000:1000 and Caddy's /data to 10002. - deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests, warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs only write:package. - Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted read-only at /secrets. - README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks, APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
39 lines
2.3 KiB
Bash
39 lines
2.3 KiB
Bash
# Kvitt Pi settings (SPEC §10.2). Copy to .env in this folder, replace every CHANGE_ME, then run ./install.sh,
|
|
# which copies it to /opt/kvitt/.env (mode 0600). install.sh refuses a .env that still contains CHANGE_ME.
|
|
# No secret files here: those go to /opt/kvitt/secrets/ (infra/README.md "Pi: what the owner does").
|
|
|
|
# --- Read by compose.yaml -----------------------------------------------------------------------------------------
|
|
|
|
# Registry and owner path of the Kvitt images; images are ${KVITT_REGISTRY}/kvitt-server|kvitt-cert-sync|kvitt-backup.
|
|
KVITT_REGISTRY=gitea.lan/jacobh2
|
|
# Image tag to run. deploy.sh sets it; first install: the newest version tag the Gitea workflow pushed (vMAJOR.MINOR.PATCH),
|
|
# or the short git SHA that infra/build-images.sh printed.
|
|
KVITT_TAG=CHANGE_ME_TAG
|
|
# LAN address (or host name) of the Home Assistant Pi that holds the Let's Encrypt certificate (OQ-3).
|
|
HA_HOST=CHANGE_ME_HA_HOST
|
|
# SSH port of the Home Assistant SSH add-on (OQ-3; the "Advanced SSH & Web Terminal" and "Terminal & SSH" add-ons default to 22).
|
|
HA_PORT=22
|
|
# SSH user on the Home Assistant Pi (OQ-3). root only with the restricted key line of infra/README.md step 3; otherwise a
|
|
# dedicated non-root user that can only read HA_CERT_DIR (D-117). A plain, unrestricted root key is not acceptable.
|
|
HA_USER=CHANGE_ME_HA_USER
|
|
# Directory holding fullchain.pem and privkey.pem on the Home Assistant Pi (OQ-3; /ssl on Home Assistant OS).
|
|
HA_CERT_DIR=CHANGE_ME_HA_CERT_DIR
|
|
# rclone remote of the Drive backups, as named in rclone.conf.
|
|
RCLONE_REMOTE=gdrive:
|
|
# Google Drive folder id the backups go to (OQ-4, answered).
|
|
RCLONE_FOLDER_ID=1jDp1dGE5R3H2DBcXCqIPN1iWzQnPkdlV
|
|
|
|
# --- Read by install.sh only (never by the containers) ------------------------------------------------------------
|
|
|
|
# Gitea user that may pull the images; leave empty when the Gitea packages are public (anonymous pull).
|
|
KVITT_REGISTRY_USER=
|
|
# Gitea access token of that user with read:package scope; leave empty for anonymous pull. Never commit a filled .env.
|
|
KVITT_REGISTRY_TOKEN=
|
|
|
|
# --- Informational: used in the owner's commands on the Mac (scp), read by nothing on the Pi --------------------
|
|
|
|
# LAN address of the Kvitt Pi itself (OQ-3).
|
|
KVITT_PI_HOST=CHANGE_ME_KVITT_PI_HOST
|
|
# SSH user on the Kvitt Pi (OQ-3).
|
|
KVITT_PI_SSH_USER=CHANGE_ME_KVITT_PI_SSH_USER
|