61 lines
2.0 KiB
Bash
61 lines
2.0 KiB
Bash
# Copy to .env and adjust. Every value here can also be supplied as a real
|
|
# environment variable (which takes precedence over the .env file).
|
|
|
|
# --- General ---
|
|
APP_NAME="FastAPI Skeleton"
|
|
DEBUG=false
|
|
|
|
# --- Security ---
|
|
# Generate a strong value, e.g. `python -c "import secrets; print(secrets.token_urlsafe(48))"`
|
|
SECRET_KEY="change-me-please-use-a-long-random-string"
|
|
ALGORITHM=HS256
|
|
ACCESS_TOKEN_EXPIRE_MINUTES=15
|
|
REFRESH_TOKEN_EXPIRE_DAYS=7
|
|
|
|
# --- Database ---
|
|
# SQLite (zero-setup default):
|
|
DATABASE_URL="sqlite+aiosqlite:///./app.db"
|
|
# Postgres example:
|
|
# DATABASE_URL="postgresql+asyncpg://app:app@localhost:5432/app"
|
|
|
|
# Create tables on startup (handy for dev/SQLite; use Alembic in production).
|
|
AUTO_CREATE_TABLES=true
|
|
|
|
# --- Web / cookies ---
|
|
COOKIE_NAME=access_token
|
|
# Set true when serving over HTTPS.
|
|
COOKIE_SECURE=false
|
|
|
|
# --- CORS (JSON list) ---
|
|
CORS_ORIGINS=["*"]
|
|
|
|
# --- LDAP / Active Directory (optional) ---
|
|
# When enabled, login credentials are validated against the directory and a
|
|
# local user is provisioned on first login. Local DB auth still works as a
|
|
# fallback (so the seeded superuser can log in). Disabled by default.
|
|
LDAP_ENABLED=false
|
|
LDAP_SERVER_URI="ldap://ldap.example.com:389"
|
|
LDAP_USE_SSL=false
|
|
LDAP_START_TLS=false
|
|
LDAP_TLS_VALIDATE=true
|
|
# LDAP_CA_CERTS_FILE="/etc/ssl/certs/ca.pem"
|
|
|
|
# Option 1 — direct bind: build the user DN from the login name.
|
|
# LDAP_BIND_DN_TEMPLATE="uid={username},ou=people,dc=example,dc=com"
|
|
|
|
# Option 2 — search + bind: a service account finds the user, then we bind as
|
|
# the found DN. Leave the template above empty to use this mode.
|
|
# LDAP_BIND_DN="cn=svc-reader,dc=example,dc=com"
|
|
# LDAP_BIND_PASSWORD="service-account-password"
|
|
# LDAP_USER_SEARCH_BASE="ou=people,dc=example,dc=com"
|
|
# LDAP_USER_SEARCH_FILTER="(uid={username})"
|
|
|
|
# Directory attributes copied onto the local user, and roles granted on first login.
|
|
LDAP_ATTR_EMAIL=mail
|
|
LDAP_ATTR_FULL_NAME=cn
|
|
LDAP_DEFAULT_ROLES=["user"]
|
|
|
|
# --- Bootstrap superuser (used by scripts/seed.py) ---
|
|
FIRST_SUPERUSER_EMAIL=admin@example.com
|
|
FIRST_SUPERUSER_PASSWORD=changethis
|