rock-n-code/ccn
1
0 Fork 0
Code Issues Pull Requests Actions Projects Releases Activity

Wired up the Website deployment for the POC prototype.

Browse Source
This commit is contained in:
javier committed 2026-09-21 16:43:54 +02:00
1 parent f2f445827b
commit 359fe0d6ac
5 files changed
+77 -34
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Services/Website/.env.local
+39 -33
View File
@@ -51,36 +51,11 @@ ANALYTICS_DOMAINS=
# Whether the pages also embed the session recorder script: true | false
ANALYTICS_RECORDER=false
# --- Security ----------------------------------------------------------------
# --- Passkeys ----------------------------------------------------------------
# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
# `X-Content-Type-Options`: disables MIME sniffing.
SECURITY_CONTENT_TYPE_OPTIONS=nosniff
# `X-Frame-Options`: DENY | SAMEORIGIN
SECURITY_FRAME_OPTIONS=DENY
# `Referrer-Policy`.
SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
# `Permissions-Policy`: denies browser features the site does not use.
SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
# remember it stickily once seen, so it stays off in local development.
# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
# --- Reverse proxy -----------------------------------------------------------
# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so
# set them together; off for a directly reachable server, where clients can forge
# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit
# buckets by the first `X-Forwarded-For` entry.
HTTPS_TRUST_FORWARDED_PROTO=false
RATE_LIMIT_TRUST_FORWARDED_FOR=false
# Origin the sign-in screen is served at; browsers bind passkeys to it.
# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1). In production it follows SITE_ORIGIN.
PASSKEYS_ORIGIN=http://localhost:8080
# --- Persistence -------------------------------------------------------------
@@ -110,8 +85,39 @@ DATABASE_TLS=off
# Username of the database to connect as.
DATABASE_USERNAME=ccn
# --- Passkeys ----------------------------------------------------------------
# --- Reverse proxy -----------------------------------------------------------
# Origin the sign-in screen is served at; browsers bind passkeys to it.
# WebAuthn only runs on HTTPS or on localhost (not 127.0.0.1).
PASSKEYS_ORIGIN=http://localhost:8080
# Both assert a TLS-terminating reverse proxy that sets the forwarded headers, so
# set them together; off for a directly reachable server, where clients can forge
# the headers. The former drives the HTTPS redirect, the latter keys the rate-limit
# buckets by the first `X-Forwarded-For` entry.
HTTPS_TRUST_FORWARDED_PROTO=false
RATE_LIMIT_TRUST_FORWARDED_FOR=false
# --- Security ----------------------------------------------------------------
# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
# `X-Content-Type-Options`: disables MIME sniffing.
SECURITY_CONTENT_TYPE_OPTIONS=nosniff
# `X-Frame-Options`: DENY | SAMEORIGIN
SECURITY_FRAME_OPTIONS=DENY
# `Referrer-Policy`.
SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin
# `Permissions-Policy`: denies browser features the site does not use.
SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
# remember it stickily once seen, so it stays off in local development.
# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains
# --- Site --------------------------------------------------------------------
# Public origin of the site (scheme and host, no trailing slash). Leave unset locally: the app's default applies, and
# the local Compose override points it at http://localhost.
# SITE_ORIGIN=https://ccn.rock-n-co.de