kitos
504dfc52f5
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
Login is now by email, not username. username still exists internally (JWT sub claim, audit logs, Jira actor attribution, SSO provisioning all still key off it) but is now always kept equal to email everywhere a user is created or their email changes — never a separately-chosen value. - User.email is now unique + NOT NULL (migration b067 backfills any missing/blank email from username first, so existing rows — notably the seeded admin, which historically had none — never violate it). - /auth/login and the (unused but updated for consistency) authenticate_user() now query by email. - create_user (legacy, unreferenced but kept) and create_user_without_password both derive username from email. - update_user keeps username in sync when email changes, and rejects duplicate emails. - seed.py reads ADMIN_EMAIL (new env var, wired through install.sh and docker-compose.prod.yml) for the initial admin; falls back to an email-shaped ADMIN_USERNAME or a placeholder that's flagged for the operator to fix. - admin_config.py's import bundle now matches/creates users by email, skipping (not crashing on) entries with no email. - sso_service.py always sets username = email for SSO-provisioned users. - LoginPage/auth.ts updated to email input/copy (wire field name stays 'username' — that's the OAuth2PasswordRequestForm spec, not the value).
55 lines
3.3 KiB
Bash
55 lines
3.3 KiB
Bash
# =============================================================================
|
|
# Aegis Environment Variables
|
|
# =============================================================================
|
|
# Copy this file to .env and fill in the values BEFORE deploying.
|
|
#
|
|
# Generate secure random values with:
|
|
# openssl rand -hex 32 (for SECRET_KEY)
|
|
# openssl rand -base64 18 (for passwords)
|
|
# =============================================================================
|
|
|
|
# ── Database ─────────────────────────────────────────────────────────────────
|
|
DB_USER=postgres
|
|
DB_PASSWORD= # REQUIRED — set a strong password
|
|
DB_NAME=attackdb
|
|
|
|
# ── Security ─────────────────────────────────────────────────────────────────
|
|
# REQUIRED in production — the app will refuse to start without it.
|
|
# Generate with: openssl rand -hex 32
|
|
SECRET_KEY=
|
|
|
|
TOKEN_EXPIRE_MINUTES=60
|
|
|
|
# ── Initial Admin Account ────────────────────────────────────────────────────
|
|
# If ADMIN_PASSWORD is empty, a random password is auto-generated and
|
|
# printed to the backend container logs on first startup.
|
|
# ADMIN_EMAIL is what you actually log in with (email is the unique
|
|
# identifier) — set it to a real address you control.
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_EMAIL=
|
|
ADMIN_PASSWORD=
|
|
|
|
# ── MinIO Object Storage ─────────────────────────────────────────────────────
|
|
MINIO_ACCESS_KEY=minioadmin
|
|
MINIO_SECRET_KEY= # REQUIRED — set a strong password
|
|
MINIO_BUCKET=evidence
|
|
MINIO_SECURE=false # Set to true if MinIO is behind TLS
|
|
|
|
# ── CORS ──────────────────────────────────────────────────────────────────────
|
|
# Comma-separated list of allowed frontend origins
|
|
CORS_ORIGINS=https://your-domain.com
|
|
|
|
# ── Frontend ─────────────────────────────────────────────────────────────────
|
|
FRONTEND_PORT=80
|
|
|
|
# ── Emails ────────────────────────────────────────────────────────────────────
|
|
# Base URL used to build links in outbound emails (set-password, etc).
|
|
# REQUIRED in production — must be THIS deployment's real public frontend
|
|
# URL. There is no safe default (it's unique per deployment); the backend
|
|
# refuses to start without it when AEGIS_ENV=production.
|
|
PLATFORM_URL=https://your-domain.com
|
|
|
|
# ── Environment flag ─────────────────────────────────────────────────────────
|
|
# Set to "production" for production deployments (enforces SECRET_KEY, etc.)
|
|
AEGIS_ENV=production
|