blob: 743541b616e1b325ecedbfb37d0a2170a42f7cbd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
# --- Server Settings ---
# The port for the proxy server to listen on
LISTEN_PORT=8080
AUTH_PROXY_PUBLISH_PORT=8080
POCKETBASE_PUBLISH_PORT=8090
# --- Required ---
# The URL of the backend service you want to protect
TARGET_URL=http://backend:80
# A long, random string for securing session cookies and JWTs
# For production, generate a new key using: openssl rand -base64 45
SESSION_SECRET=
# (Required) A 32-byte random key for XSRF protection.
# Generate with: openssl rand -base64 32
XSRF_SECRET_KEY=
# --- PocketBase ---
POCKETBASE_URL=http://pocketbase:8090
POCKETBASE_COLLECTION=proxy_users
POCKETBASE_IDENTITY_FIELD=username
POCKETBASE_SUPERUSER_EMAIL=admin@example.com
POCKETBASE_SUPERUSER_PASSWORD=change-me-now
POCKETBASE_EMAIL_DOMAIN=pb-auth.local
# --- Frontend & Proxy ---
# Frontend mode: "js" (default) or "php"
FRONTEND_TYPE=js
# If true, protects the frontend path with session authentication
PROTECT_FRONTEND=true
# If true, protects the API path with bearer token authentication
PROTECT_API=true
# Base path for frontend routes to be protected
FRONT_PATH=/
# Base path for API routes to be protected
API_PATH=/api/
# --- Security Policies ---
# Brute-force protection settings
MAX_LOGIN_ATTEMPTS=5
LOCKOUT_DURATION_MINUTES=10
# User creation rate limit settings
USER_CREATION_RATE_LIMIT_MAX_REQUESTS=5
USER_CREATION_RATE_LIMIT_WINDOW_SECONDS=3600
# Password policy (none, standard, enhanced, strict)
PASSWORD_POLICY=standard
# --- Token Durations ---
# Duration for the web session cookie
TOKEN_DURATION_HOURS=24
# Duration for the API JWT access token
ACCESS_TOKEN_DURATION_MINUTES=15
# Duration for the API JWT refresh token
REFRESH_TOKEN_DURATION_DAYS=7
# --- Optional: Path Overrides ---
# Uncomment and change these to avoid URL conflicts with your backend application.
# AUTH_PATH_LOGIN=/login
# AUTH_PATH_REGISTER=/register
# AUTH_PATH_LOGOUT=/logout
# AUTH_PATH_ACCOUNT=/account
# AUTH_PATH_ACCOUNT_PASSWORD=/account/password
# AUTH_PATH_ADMIN=/admin
# AUTH_PATH_ADMIN_USERS_API=/api/admin/users
# AUTH_ASSETS_PATH=/assets
# --- PHP Frontend Settings (only needed if FRONTEND_TYPE=php) ---
# PHP_FPM_SOCKET=/run/php-fpm/php-fpm.sock
# PHP_DOC_ROOT=
|
