1. Password reset tokens: use crypto/rand instead of math/rand 2. IP spoofing: only trust X-Forwarded-For from configured trusted proxies 3. Cleanup: purge failed login attempts older than 24 hours 4. JWT secret: validate minimum 32 character length on startup Updated .env.example with TRUSTED_PROXIES setting
20 lines
435 B
Text
20 lines
435 B
Text
# Database
|
|
DB_HOST=localhost
|
|
DB_PORT=3306
|
|
DB_USER=mailadmin
|
|
DB_PASSWORD=your-password
|
|
DB_NAME=mailserver
|
|
|
|
# App
|
|
PORT=8080
|
|
USE_EMBEDDED=true
|
|
JWT_SECRET=your-random-secret-at-least-32-chars
|
|
TRUSTED_PROXIES=127.0.0.1
|
|
|
|
# Mail server paths
|
|
MAIL_DATA_DIR=/var/vmail
|
|
POSTQUEUE_PATH=/usr/sbin/postqueue
|
|
POSTSUPER_PATH=/usr/sbin/postsuper
|
|
DOVECOT_QUOTA_CMD=/usr/bin/doveadm
|
|
JOURNALCTL_PATH=/usr/bin/journalctl
|
|
RSPMAD_API=http://127.0.0.1:11334
|