imc-vibe/backend/.env.example
Christoph Haas 269fb6f53a Security fixes
1. Password reset tokens: use crypto/rand instead of math/rand
2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies
3. Cleanup: purge failed login attempts older than 24 hours
4. JWT secret: validate minimum 32 character length on startup

Updated .env.example with TRUSTED_PROXIES setting
2026-03-23 01:09:26 +01:00

20 lines
435 B
Text

# Database
DB_HOST=localhost
DB_PORT=3306
DB_USER=mailadmin
DB_PASSWORD=your-password
DB_NAME=mailserver
# App
PORT=8080
USE_EMBEDDED=true
JWT_SECRET=your-random-secret-at-least-32-chars
TRUSTED_PROXIES=127.0.0.1
# Mail server paths
MAIL_DATA_DIR=/var/vmail
POSTQUEUE_PATH=/usr/sbin/postqueue
POSTSUPER_PATH=/usr/sbin/postsuper
DOVECOT_QUOTA_CMD=/usr/bin/doveadm
JOURNALCTL_PATH=/usr/bin/journalctl
RSPMAD_API=http://127.0.0.1:11334