20a0f3d6af
Major changes: - Remove username and password_hash from User model - Add MagicLinkToken table for one-time-use email authentication - Implement Magic Link email sending with 15-minute expiration - Update all auth endpoints (/login, /signup) to use email only - Create verify-signup and verify-login pages for token verification - Container URLs now use slug instead of username (e.g., /u-a3f9c2d1) - Add rate limiting: max 3 Magic Links per email per hour - Remove password reset functionality (no passwords to reset) Backend changes: - api.py: Complete rewrite of auth routes (magic link based) - models.py: Remove username/password, add slug and MagicLinkToken - email_service.py: Add Magic Link generation and email sending - admin_api.py: Remove password reset, update to use email identifiers - container_manager.py: Use slug instead of username for routing - config.py: Add MAGIC_LINK_TOKEN_EXPIRY and MAGIC_LINK_RATE_LIMIT Frontend changes: - src/lib/api.ts: Update auth functions and User interface - src/hooks/use-auth.tsx: Implement verifySignup/verifyLogin - src/app/login/page.tsx: Email-only login form - src/app/signup/page.tsx: Email-only signup form - src/app/verify-signup/page.tsx: NEW - Signup token verification - src/app/verify-login/page.tsx: NEW - Login token verification - src/app/dashboard/page.tsx: Display slug instead of username Infrastructure: - install.sh: Simplified, no migration needed (db.create_all handles it) - .env.example: Add MAGIC_LINK_TOKEN_EXPIRY and MAGIC_LINK_RATE_LIMIT - Add IMPLEMENTATION-GUIDE.md with detailed setup instructions Security improvements: - No password storage = no password breaches - One-time-use tokens prevent replay attacks - 15-minute token expiration limits attack window - Rate limiting prevents email flooding Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
122 lines
4.2 KiB
Plaintext
122 lines
4.2 KiB
Plaintext
# Container Spawner Konfiguration
|
|
# Kopiere diese Datei nach .env und passe die Werte an
|
|
# cp .env.example .env
|
|
|
|
# ============================================================
|
|
# PFLICHT - Diese Werte MUESSEN angepasst werden
|
|
# ============================================================
|
|
|
|
# Flask Session Secret - Generiere mit:
|
|
# python3 -c "import secrets; print(secrets.token_hex(32))"
|
|
SECRET_KEY=HIER_DEINEN_GEHEIMEN_SCHLUESSEL_EINTRAGEN
|
|
|
|
# Deine Domain (z.B. example.com, wieland.org)
|
|
BASE_DOMAIN=example.com
|
|
|
|
# Subdomain fuer den Spawner (z.B. coder -> coder.example.com)
|
|
SPAWNER_SUBDOMAIN=coder
|
|
|
|
# Name des Traefik-Netzwerks (muss existieren oder wird erstellt)
|
|
TRAEFIK_NETWORK=web
|
|
|
|
# ============================================================
|
|
# TRAEFIK - Anpassen an deine Traefik-Konfiguration
|
|
# ============================================================
|
|
|
|
# Name des Traefik Certificate Resolvers (aus deiner traefik.yml)
|
|
# Typische Namen: lets-encrypt, letsencrypt, hetzner, cloudflare, default
|
|
TRAEFIK_CERTRESOLVER=lets-encrypt
|
|
|
|
# Traefik Entrypoint fuer HTTPS (Standard: websecure)
|
|
TRAEFIK_ENTRYPOINT=websecure
|
|
|
|
# ============================================================
|
|
# DOCKER - Normalerweise keine Aenderung noetig
|
|
# ============================================================
|
|
|
|
# Docker Socket Pfad (Standard fuer Linux)
|
|
# Fuer Windows: npipe:////./pipe/docker_engine
|
|
# Fuer TCP: tcp://localhost:2375
|
|
DOCKER_HOST=unix:///var/run/docker.sock
|
|
|
|
# Docker-Image fuer User-Container
|
|
# Verfuegbare Templates:
|
|
# - user-service-template:latest (nginx, einfache Willkommensseite)
|
|
# - user-template-next:latest (Next.js, moderne React-App)
|
|
USER_TEMPLATE_IMAGE=user-service-template:latest
|
|
|
|
# ============================================================
|
|
# RESSOURCEN - Container-Limits
|
|
# ============================================================
|
|
|
|
# RAM-Limit pro User-Container
|
|
DEFAULT_MEMORY_LIMIT=512m
|
|
|
|
# CPU-Quota (50000 = 0.5 CPU, 100000 = 1 CPU)
|
|
DEFAULT_CPU_QUOTA=50000
|
|
|
|
# ============================================================
|
|
# JWT - Authentifizierung
|
|
# ============================================================
|
|
|
|
# JWT Secret (verwendet SECRET_KEY wenn nicht gesetzt)
|
|
# JWT_SECRET_KEY=
|
|
|
|
# JWT Token Gueltigkeitsdauer in Sekunden (Standard: 1 Stunde)
|
|
JWT_ACCESS_TOKEN_EXPIRES=3600
|
|
|
|
# ============================================================
|
|
# CORS - Cross-Origin Resource Sharing
|
|
# ============================================================
|
|
|
|
# CORS erlaubte Origins (kommasepariert)
|
|
# WICHTIG: Wird automatisch aus SPAWNER_SUBDOMAIN und BASE_DOMAIN generiert
|
|
# Nur setzen wenn du zusaetzliche Origins brauchst
|
|
# CORS_ORIGINS=https://coder.example.com,http://localhost:3000
|
|
|
|
# ============================================================
|
|
# OPTIONAL - Logging und Debugging
|
|
# ============================================================
|
|
|
|
# Spawner-Port (intern, nur fuer direkten Zugriff)
|
|
SPAWNER_PORT=5000
|
|
|
|
# Log-Level (DEBUG, INFO, WARNING, ERROR)
|
|
LOG_LEVEL=INFO
|
|
|
|
# Container-Timeout in Sekunden (fuer Auto-Shutdown, noch nicht implementiert)
|
|
CONTAINER_IDLE_TIMEOUT=3600
|
|
|
|
# ============================================================
|
|
# PASSWORDLESS AUTH - Magic Links
|
|
# ============================================================
|
|
|
|
# Gueltigkeitsdauer von Magic Link Tokens in Sekunden (Standard: 15 Minuten)
|
|
MAGIC_LINK_TOKEN_EXPIRY=900
|
|
|
|
# Max. Anzahl Magic Links pro Email-Adresse pro Stunde (Rate Limiting)
|
|
MAGIC_LINK_RATE_LIMIT=3
|
|
|
|
# ============================================================
|
|
# EMAIL - Magic Links und Benachrichtigungen
|
|
# ============================================================
|
|
|
|
# SMTP-Server Konfiguration
|
|
SMTP_HOST=smtp.example.com
|
|
SMTP_PORT=587
|
|
SMTP_USER=noreply@example.com
|
|
SMTP_PASSWORD=your-smtp-password
|
|
SMTP_FROM=noreply@example.com
|
|
SMTP_USE_TLS=true
|
|
|
|
# Frontend-URL fuer Email-Links (Magic Links, etc.)
|
|
# WICHTIG: Muss die URL sein, unter der das Frontend erreichbar ist
|
|
FRONTEND_URL=https://coder.example.com
|
|
|
|
# ============================================================
|
|
# PRODUKTION - Erweiterte Einstellungen
|
|
# ============================================================
|
|
|
|
# PostgreSQL statt SQLite (empfohlen fuer Produktion)
|
|
# DATABASE_URL=postgresql://spawner:password@postgres:5432/spawner
|