Jannis Braun
7c544c1ff4
- SSRF protection: DNS resolution + private IP blocking on metadata fetcher - Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff - Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at - Attachment ownership verification before linking to messages - Message length limit (4000 chars) enforced on client and server - Asset URL validation on avatar/banner updates - Federation instance validation (domain regex, origin scheme, length limits) - DB indexes on all FK columns for query performance - Migrations: nullable moderator columns, dm_messages reply_to FK constraint - File cleanup on avatar/banner replacement and space deletion - Fastify trustProxy, AbortController on fetches, typing map size cap
62 lines
1.9 KiB
TypeScript
62 lines
1.9 KiB
TypeScript
import { config as dotenvConfig } from 'dotenv';
|
|
import { resolve, dirname } from 'path';
|
|
import { fileURLToPath } from 'url';
|
|
|
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
|
|
dotenvConfig({ path: resolve(__dirname, '../../../.env') });
|
|
|
|
function env(key: string, defaultValue?: string): string {
|
|
const value = process.env[key] ?? defaultValue;
|
|
if (value === undefined) {
|
|
throw new Error(`Missing required environment variable: ${key}`);
|
|
}
|
|
return value;
|
|
}
|
|
|
|
function envOptional(key: string): string | undefined {
|
|
return process.env[key] || undefined;
|
|
}
|
|
|
|
function envInt(key: string, defaultValue: number): number {
|
|
const value = process.env[key];
|
|
if (value === undefined) return defaultValue;
|
|
const parsed = parseInt(value, 10);
|
|
if (isNaN(parsed)) {
|
|
throw new Error(`Environment variable ${key} must be a number, got: ${value}`);
|
|
}
|
|
return parsed;
|
|
}
|
|
|
|
function envBool(key: string, defaultValue: boolean): boolean {
|
|
const value = process.env[key];
|
|
if (value === undefined) return defaultValue;
|
|
return value === 'true' || value === '1';
|
|
}
|
|
|
|
export const config = {
|
|
port: envInt('PORT', 3000),
|
|
host: env('HOST', '0.0.0.0'),
|
|
jwtSecret: env('JWT_SECRET'),
|
|
jwtExpiresIn: env('JWT_EXPIRES_IN', '30d'),
|
|
domain: envOptional('DOMAIN'),
|
|
|
|
livekit: {
|
|
url: envOptional('LIVEKIT_URL'),
|
|
apiKey: envOptional('LIVEKIT_API_KEY'),
|
|
apiSecret: envOptional('LIVEKIT_API_SECRET'),
|
|
},
|
|
|
|
uploadDir: env('UPLOAD_DIR', resolve(__dirname, '../../../data/uploads')),
|
|
dbPath: env('DB_PATH', resolve(__dirname, '../../../data/backspace.db')),
|
|
maxUploadSize: envInt('MAX_UPLOAD_SIZE', 104857600),
|
|
registrationOpen: envBool('REGISTRATION_OPEN', true),
|
|
} as const;
|
|
|
|
if (config.jwtSecret.length < 32) {
|
|
throw new Error(
|
|
`JWT_SECRET must be at least 32 characters (got ${config.jwtSecret.length}). ` +
|
|
`Generate one with: openssl rand -hex 32`
|
|
);
|
|
}
|