Harden immutable release deployment

2026-07-18 02:31:28 +02:00
parent 611ad0cd57
commit 5699006a5e
20 changed files with 477 additions and 151 deletions
@@ -14,6 +14,8 @@ GEOINTEL_MODELS_PATH=/mnt/user/appdata/geointel/models
 GEOINTEL_POSTGIS_DATA_PATH=/mnt/user/appdata/geointel/postgres-data

 # Internal embedded PostGIS settings. The database is not published to the LAN.
+# Replace the placeholder with a unique secret before the first start. Production
+# startup rejects empty and known-default passwords.
 GEOINTEL_POSTGRES_DB=geointel
 GEOINTEL_POSTGRES_USER=geointel
 GEOINTEL_POSTGRES_PASSWORD=change-me-before-shared-use
@@ -21,7 +23,7 @@ GEOINTEL_POSTGRES_PASSWORD=change-me-before-shared-use
 # Browser origins allowed when directly calling the backend API.
 GEOINTEL_CORS_ORIGINS=http://localhost:1202,http://127.0.0.1:1202,http://192.168.10.150:1202

-# Upload guard in MiB.
+# Upload guard in MiB. The same 1-2048 limit is applied by nginx and FastAPI.
 GEOINTEL_MAX_UPLOAD_MB=500

 # Explicit, bounded acquisition from the official Digitaal Vlaanderen WMS.