A R R R Associates
51 lines
1.4 KiB
Bash
51 lines
1.4 KiB
Bash
APP_NAME="Audit Firm v2"
|
|
ENV="dev"
|
|
DEBUG=true
|
|
|
|
# IMPORTANT: change in production
|
|
SECRET_KEY="change-me-to-a-long-random-string"
|
|
|
|
# Cookie/security
|
|
COOKIE_SECURE=false
|
|
COOKIE_SAMESITE="lax" # lax|strict|none
|
|
COOKIE_SESSION_NAME="af2sid"
|
|
|
|
# DB backend
|
|
DB_BACKEND="sqlite" # sqlite|postgres
|
|
|
|
SQLITE_COMMON_PATH="./data/common.db"
|
|
|
|
ERP_PUBLIC_BASE_URL=http://localhost:8000
|
|
DEV_AUTH_OTP_PRINT=false
|
|
|
|
# Postgres placeholders (later)
|
|
PG_HOST="127.0.0.1"
|
|
PG_PORT=5432
|
|
PG_USER="postgres"
|
|
PG_PASSWORD="postgres"
|
|
PG_DB_COMMON="audit_common"
|
|
|
|
# Defaults (context fallback)
|
|
DEFAULT_TENANT_CODE="default"
|
|
DEFAULT_BRANCH_CODE="main"
|
|
DEFAULT_YEAR_CODE="2025-26"
|
|
DEFAULT_TIMEZONE="Asia/Kolkata"
|
|
|
|
# Security hardening: do not trust browser/client supplied context headers in public deployment.
|
|
# Keep false for production unless an internal proxy/test runner is explicitly trusted.
|
|
TRUST_CONTEXT_HEADERS=false
|
|
TRUST_CONTEXT_HEADER_HOSTS="127.0.0.1,localhost,::1"
|
|
# Optional shared secret for trusted internal callers. If set, caller must send
|
|
# X-AuditFirm-Context-Secret with this value before context headers are accepted.
|
|
CONTEXT_HEADER_SECRET=""
|
|
|
|
# Bootstrap admin (seeded if users table is empty)
|
|
BOOTSTRAP_ADMIN_EMAIL="admin@auditfirm.local"
|
|
BOOTSTRAP_ADMIN_PASSWORD="ChangeMe@123"
|
|
|
|
# JWT for API clients (mobile/apps/integrations)
|
|
JWT_ISSUER="audit_firm_v2"
|
|
JWT_AUDIENCE="audit_firm_clients"
|
|
JWT_ACCESS_MINUTES=15
|
|
JWT_REFRESH_DAYS=30
|