mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
fd36389328
POST /buckets/:id/object-presigns mints SigV4 query-signed GET/PUT URLs so clients move bytes directly against S3 — large transfers skip the backend entirely. - storage.Presigner optional interface; S3Store implements, local driver returns a clear error (no external surface to sign). - TTL 60s–1h (default 15m); download requires read role + existing object row (no key probing); upload requires write role. - S3_PUBLIC_ENDPOINT rewrites the client-facing host for internal S3_ENDPOINTs — signatures bind the host, URLs are valid only where minted. - CLI: primora objects:presign <bucket> <key> [--upload] [--ttl]. Verified live against cloudserver: GET fetched the object with no auth headers; PUT pushed 1 MB direct to S3; unsigned list → 403; untracked-key download presign → 404. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
91 lines
2.9 KiB
Bash
91 lines
2.9 KiB
Bash
NODE_ENV=development
|
|
|
|
POSTGRES_USER=primora
|
|
POSTGRES_PASSWORD=primora
|
|
POSTGRES_DB=primora
|
|
POSTGRES_HOST=postgres
|
|
POSTGRES_PORT=5432
|
|
DATABASE_URL=postgres://primora:primora@postgres:5432/primora?sslmode=disable
|
|
|
|
DRAGONFLY_HOST=dragonfly
|
|
DRAGONFLY_PORT=6379
|
|
DRAGONFLY_URL=redis://dragonfly:6379/0
|
|
USER_RATE_LIMIT_PER_MINUTE=240
|
|
API_KEY_RATE_LIMIT_PER_MINUTE=600
|
|
|
|
JWT_ISSUER=primora-auth
|
|
JWT_AUDIENCE=primora-api
|
|
JWT_SECRET=change-me-super-long-jwt-secret
|
|
JWT_TTL_SECONDS=900
|
|
|
|
# AES-256 key (32 bytes, hex or base64) encrypting integration credentials and
|
|
# webhook secrets at rest. Required in production; dev falls back to this value.
|
|
PRIMORA_ENCRYPTION_KEY=3031323334353637383961626364656630313233343536373839616263646566
|
|
|
|
AUTH_PORT=3001
|
|
AUTH_BASE_URL=http://localhost/auth
|
|
AUTH_INTERNAL_BASE_URL=http://auth:3001
|
|
BETTER_AUTH_SECRET=change-me-super-long-better-auth-secret
|
|
BETTER_AUTH_URL=http://localhost/auth
|
|
# Comma-separated emails promoted to auth admin on boot (Authentication → Users panel)
|
|
AUTH_ADMIN_EMAILS=
|
|
# The first public sign-up always becomes the instance admin. With no users the
|
|
# login page shows only the sign-up form. After bootstrap, public sign-up is
|
|
# closed unless SIGNUP_ENABLED=true or the admin enables it in-app
|
|
# (Settings → Instance). In-app values override this file.
|
|
SIGNUP_ENABLED=false
|
|
# Managed tier flag — OAuth providers activate only when this is "true".
|
|
# Self-hosted instances are email/password regardless of the keys below.
|
|
PRIMORA_MANAGED=false
|
|
COOKIE_DOMAIN=localhost
|
|
|
|
FRONTEND_PORT=3000
|
|
VITE_APP_URL=http://localhost
|
|
VITE_AUTH_BASE_URL=http://localhost/auth
|
|
VITE_API_BASE_URL=http://localhost/api/v1
|
|
VITE_DEMO_MODE=false
|
|
|
|
BACKEND_PORT=8080
|
|
BACKEND_PUBLIC_URL=http://localhost/api/v1
|
|
BACKEND_INTERNAL_URL=http://backend:8080
|
|
BACKEND_STORAGE_ROOT=/data/storage
|
|
|
|
# Object storage driver: "local" (default, uses BACKEND_STORAGE_ROOT) or "s3".
|
|
# For s3, point S3_ENDPOINT at any S3-compatible API (AWS, MinIO, Garage, R2).
|
|
BACKEND_STORAGE_DRIVER=local
|
|
#S3_ENDPOINT=http://minio:9000
|
|
#S3_REGION=us-east-1
|
|
#S3_BUCKET=primora-objects
|
|
#S3_ACCESS_KEY_ID=
|
|
#S3_SECRET_ACCESS_KEY=
|
|
#S3_PREFIX=
|
|
#S3_PATH_STYLE=true
|
|
# Client-facing S3 endpoint for presigned URLs — set when S3_ENDPOINT is an
|
|
# internal address (e.g. http://minio:9000 inside compose) that browsers
|
|
# can't reach. Presigned URLs are valid only at the host they were minted for.
|
|
#S3_PUBLIC_ENDPOINT=https://objects.example.com
|
|
|
|
# Mail defaults — each is overridable in-app (Settings → Instance). In-app
|
|
# values win over these env vars; deleting the in-app value reverts here.
|
|
RESEND_API_KEY=
|
|
MAIL_FROM=Primora <[email protected]>
|
|
SMTP_HOST=mailpit
|
|
SMTP_PORT=1025
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_SECURE=false
|
|
|
|
# OAuth keys only take effect when PRIMORA_MANAGED=true (managed tier).
|
|
GITHUB_CLIENT_ID=
|
|
GITHUB_CLIENT_SECRET=
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
DISCORD_CLIENT_ID=
|
|
DISCORD_CLIENT_SECRET=
|
|
MICROSOFT_CLIENT_ID=
|
|
MICROSOFT_CLIENT_SECRET=
|
|
MICROSOFT_TENANT_ID=
|
|
|
|
NGINX_PORT=80
|
|
MAILPIT_HTTP_PORT=8025
|