113 lines
4.6 KiB
Text
113 lines
4.6 KiB
Text
# Environment variables
|
|
# Copy this file to .env and adjust as needed: cp .env.example .env
|
|
|
|
SECRET_KEY="django-insecure-dev-key-please-change-in-production"
|
|
ENV_TYPE="dev"
|
|
DEBUG=True
|
|
DOMAIN_NAME="http://localhost:8000"
|
|
|
|
# The web app's base URL. Every link this system emails is built from it: the
|
|
# magic-link sign-in URL, the customer's invoice and estimate portal links, the
|
|
# CSAT survey, and the internal "assigned to you" notifications. Outside dev
|
|
# (ENV_TYPE other than "dev") a loopback value is refused at startup, because
|
|
# left at this default it mails customers a link to their own machine.
|
|
FRONTEND_URL="http://localhost:5181"
|
|
|
|
# AWS (only needed for production / S3 storage)
|
|
AWS_BUCKET_NAME=""
|
|
AWS_ACCESS_KEY_ID=""
|
|
AWS_SECRET_ACCESS_KEY=""
|
|
AWS_SES_REGION_NAME=""
|
|
AWS_SES_REGION_ENDPOINT=""
|
|
|
|
# DB
|
|
DB_HOST="16.113.106.152"
|
|
DB_PORT="5432"
|
|
DB_USER="vignesh"
|
|
DB_PASSWORD="vignesh_secret_pass_2026"
|
|
DB_NAME="tradhoxcrm"
|
|
DBNAME="tradhoxcrm"
|
|
DBUSER="vignesh"
|
|
DBPASSWORD="vignesh_secret_pass_2026"
|
|
DBHOST="16.113.106.152"
|
|
DBPORT="5432"
|
|
|
|
# Sentry (optional)
|
|
SENTRY_DSN=""
|
|
|
|
# Celery
|
|
CELERY_BROKER_URL="redis://localhost:6379/0"
|
|
CELERY_RESULT_BACKEND="redis://localhost:6379/0"
|
|
|
|
# Google OAuth (optional: leave blank to disable)
|
|
GOOGLE_CLIENT_ID=""
|
|
GOOGLE_CLIENT_SECRET=""
|
|
|
|
# Email (use "django.core.mail.backends.console.EmailBackend" for dev, "django_ses.SESBackend" for AWS SES)
|
|
EMAIL_BACKEND="django.core.mail.backends.console.EmailBackend"
|
|
DEFAULT_FROM_EMAIL="noreply@localhost"
|
|
ADMIN_EMAIL="admin@localhost"
|
|
|
|
# SMTP (only read when EMAIL_BACKEND is "django.core.mail.backends.smtp.EmailBackend").
|
|
# For Mailtrap's Email Sandbox: EMAIL_HOST="sandbox.smtp.mailtrap.io", EMAIL_PORT=2525,
|
|
# EMAIL_USE_TLS=True; see docs/self-hosting/email-and-celery.md.
|
|
EMAIL_HOST=""
|
|
EMAIL_PORT=
|
|
EMAIL_HOST_USER=""
|
|
EMAIL_HOST_PASSWORD=""
|
|
EMAIL_USE_TLS=False
|
|
|
|
ALLOWED_HOSTS=localhost,127.0.0.1
|
|
CORS_ALLOWED_ORIGINS=http://localhost:5181,http://127.0.0.1:5181
|
|
CSRF_TRUSTED_ORIGINS=http://localhost:5181
|
|
|
|
# Set to True only when TLS is terminated by a proxy in front of Django and that
|
|
# proxy is the only way in. It makes Django trust X-Forwarded-Proto, which is
|
|
# what lets the HSTS settings emit a header at all. Leave False for direct HTTP
|
|
# or the header becomes something any caller can forge.
|
|
TRUST_PROXY_SSL_HEADER=False
|
|
|
|
# Reverse proxies in front of Django that append to X-Forwarded-For (nginx with
|
|
# $proxy_add_x_forwarded_for is one). Every recorded client IP (audit log, web
|
|
# form submissions, estimate acceptance, sign-in tokens) and every per-IP
|
|
# throttle trusts only that many entries from the right; unset uses REMOTE_ADDR.
|
|
# Leave it unset if the app server already resolves the client from trusted
|
|
# proxies (uvicorn --proxy-headers --forwarded-allow-ips=127.0.0.1). Set it to 1
|
|
# when REMOTE_ADDR is the proxy itself (gunicorn behind one nginx), or every
|
|
# visitor shares the proxy's throttle bucket. Never set it on top of uvicorn's
|
|
# proxy handling: SvelteKit-relayed requests would then all count as the relay.
|
|
NUM_PROXIES=
|
|
|
|
# Shared secret with the SvelteKit servers that relay anonymous visitors (the
|
|
# web app's sign-in pages, help center and estimate portal, the marketing
|
|
# site's contact form). A request carrying it in X-BottleCRM-Relay-Secret is believed about
|
|
# the visitor address in X-BottleCRM-Client-IP, so each visitor gets their own
|
|
# per-IP throttle bucket and recorded address instead of the relay's. Set the
|
|
# same value as RELAY_SECRET on each SvelteKit service. At least 32 characters
|
|
# or the app refuses to start; leave empty to turn it off. Generate with:
|
|
# python -c "import secrets; print(secrets.token_urlsafe(48))"
|
|
RELAY_SECRET=
|
|
|
|
# Shared cache. Required in production for DRF throttling to be enforced across
|
|
# workers rather than per process. Without it the public web form rate limits
|
|
# are per gunicorn worker and reset on restart.
|
|
CACHE_URL=""
|
|
|
|
# Public web form submission limits (issue #634). The first is per client IP
|
|
# per form; the second is per form across all clients and is the layer that
|
|
# X-Forwarded-For rotation cannot evade.
|
|
WEBFORM_THROTTLE_IP="10/hour"
|
|
WEBFORM_THROTTLE_GLOBAL="200/day"
|
|
|
|
# Magic-link and customer portal sign-in request limits. The first of each is
|
|
# per client IP; without RELAY_SECRET every web sign-in shares the SvelteKit
|
|
# server's bucket, so keep it roomy. The global one pauses sign-in email for
|
|
# everyone when reached; the portal one, for one org.
|
|
MAGIC_LINK_THROTTLE_IP="30/hour"
|
|
MAGIC_LINK_THROTTLE_GLOBAL="300/hour"
|
|
PORTAL_LOGIN_THROTTLE_IP="30/hour"
|
|
PORTAL_LOGIN_THROTTLE_ORG="100/hour"
|
|
|
|
# Contacts and leads import limit, per signed-in user, shared by the preview
|
|
# and commit endpoints. Each upload parses up to 5,000 rows.
|
|
IMPORT_THROTTLE="30/minute"
|