Claus Lohmar
57610cdbae
- PROJECT_PLAN.md: the decision log of record through D-042 and the M0.1 slice - docs/specs: SPEC-002…009 — routing · door · identity/sessions · /setup · enroll/login · roles/chain/recovery · module registry · the web layer & PWA (plus docs/specs/README.md, the index) - AGENT.md: the working rules — commit AND push at every submilestone (gate green), Conventional Commits, never commit secrets - README.md: the quickstart, the first-run/SSH-tunnel steps and the localhost/loopback caveat (SPEC-009 §13 Q-3): with an https base URL the CSRF/session cookies are Secure, so reach the app at localhost/127.0.0.1 - config.example.yaml: the settings template (D-035)
55 lines
2.8 KiB
YAML
55 lines
2.8 KiB
YAML
# MyDay — example configuration.
|
|
#
|
|
# Copy to `config.yaml` (gitignored — NEVER committed, D-010) and fill in.
|
|
# Settings live HERE, not in the database (D-035).
|
|
|
|
# ── setup & recovery ─────────────────────────────────────────────────────────
|
|
setup: true # D-015 / D-026 — while true the app serves ONLY /setup (loopback-only)
|
|
admin_recovery: false # D-033 — set true + restart to email user 1 an enrolment link
|
|
|
|
# ── server ───────────────────────────────────────────────────────────────────
|
|
server:
|
|
listen: "127.0.0.1:8080" # D-025 — loopback during setup; bind the public iface only after
|
|
base_url: "https://myday.example.com" # used in invite / recovery links
|
|
trusted_proxies: # XFF is resolved from these (A6)
|
|
- "127.0.0.1"
|
|
|
|
# ── app ──────────────────────────────────────────────────────────────────────
|
|
app:
|
|
locale: "en-GB"
|
|
timezone: "Europe/London"
|
|
|
|
# ── enrollment (A1) ──────────────────────────────────────────────────────────
|
|
# The bounded invite window: outside it, /{GUID} enrollment is refused.
|
|
enrollment:
|
|
window: "72h"
|
|
|
|
# ── database (D-012) ─────────────────────────────────────────────────────────
|
|
database:
|
|
path: "./data/myday.db" # SQLite · WAL · foreign keys ON · one instance only
|
|
|
|
# ── secrets — generate strong random values; never commit (D-010) ────────────
|
|
secrets:
|
|
session_key: "CHANGE_ME_32_BYTES_RANDOM"
|
|
cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
|
|
csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
|
|
totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM" # A9 — TOTP secrets are encrypted at rest
|
|
|
|
# ── mail — invites & recovery ────────────────────────────────────────────────
|
|
mail:
|
|
host: "smtp.example.com"
|
|
port: 587
|
|
username: ""
|
|
password: "CHANGE_ME"
|
|
from: "myday@example.com"
|
|
|
|
# ── modules (D-038) — required modules cannot be disabled ────────────────────
|
|
modules:
|
|
org: true
|
|
time: true
|
|
absence: true
|
|
requests: true # required
|
|
hr: true
|
|
expense: false
|
|
reports: true
|
|
integrations: false
|