jaredandClaude Sonnet 5
c78d24154a
TRUSTED_PROXIES ships empty in .env.example, which disables AuthMiddleware's reverse-proxy allowlist entirely — a fresh deployment that doesn't explicitly set it has zero verification that Remote-User/Remote-Groups headers actually came from the trusted Authelia proxy. Anything that can reach the app directly (a misconfigured firewall rule, an exposed container port, SSRF from another internal service) can set Remote-User: admin and fully impersonate any user with zero authentication. The enforcement logic itself was already correct; this was purely a dangerous, easy-to-miss default. Added a boxed, unmissable warning around TRUSTED_PROXIES in .env.example (previously just an inline comment easy to skim past), added the same warning to README's setup instructions (which didn't mention this variable at all), and added a Check 8 to api/health.php that reports a 'warning' status when TRUSTED_PROXIES is empty, so a deployment that forgets it doesn't go unnoticed after the fact. Verified against real MariaDB via a running server: the health endpoint correctly reports 'warning' when empty and 'ok' once set. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lhz7pGMaoTfL5sdYS5XiKv
87 lines
3.7 KiB
Bash
87 lines
3.7 KiB
Bash
; Tinker Tickets Environment Configuration
|
|
; Copy this file to .env and fill in your values
|
|
;
|
|
; NOTE: This file is parsed with PHP's parse_ini_file. Any value containing
|
|
; special characters -- #, ;, =, quotes, spaces, etc. -- MUST be wrapped in
|
|
; double quotes, e.g. DB_PASS="p@ss;word#1". The application now fails loudly
|
|
; -- dies with a clear error -- if the .env file cannot be parsed, so an
|
|
; unquoted special character will take the whole app down rather than
|
|
; silently using a wrong value.
|
|
;
|
|
; Comments in this file use ";" rather than "#": PHP's ini parser treats "#"
|
|
; comments as fragile -- punctuation like parentheses or quotes inside a "#"
|
|
; comment can produce a syntax error even though the line is meant to be
|
|
; inert, silently breaking every value below it. ";" comments don't have this
|
|
; problem, so keep using ";" for any comment added to this file.
|
|
|
|
; Database Configuration
|
|
DB_HOST=10.10.10.50
|
|
DB_USER=tinkertickets
|
|
DB_PASS=your_password_here
|
|
DB_NAME=ticketing_system
|
|
|
|
; Matrix Webhook (optional - for notifications via matrix-hookshot)
|
|
; Set to your hookshot generic webhook URL, e.g.:
|
|
; https://matrix.lotusguild.org/webhook/uuid-goes-here
|
|
MATRIX_WEBHOOK_URL=
|
|
|
|
; Matrix users to @mention on every new ticket (comma-separated Matrix user IDs)
|
|
; e.g. @jared:matrix.lotusguild.org,@alice:matrix.lotusguild.org
|
|
MATRIX_NOTIFY_USERS=
|
|
|
|
; Matrix homeserver domain (used to build Matrix user IDs from LLDAP usernames)
|
|
MATRIX_DOMAIN=
|
|
|
|
; Synapse internal URL and admin token (used to resolve usernames -> Matrix IDs
|
|
; for watcher DMs)
|
|
SYNAPSE_ADMIN_URL=
|
|
SYNAPSE_ADMIN_TOKEN=
|
|
|
|
; Optional: send a Matrix notification on comments and/or assignments (0/1)
|
|
MATRIX_NOTIFY_COMMENTS=0
|
|
MATRIX_NOTIFY_ASSIGNMENTS=0
|
|
|
|
; Application Domain (required for Matrix webhook ticket links)
|
|
; Set this to your public domain, e.g. t.lotusguild.org
|
|
APP_DOMAIN=
|
|
|
|
; Allowed Hosts for HTTP_HOST validation (comma-separated)
|
|
; Include all domains that can access this application
|
|
ALLOWED_HOSTS=localhost,127.0.0.1
|
|
|
|
; ============================================================================
|
|
; REQUIRED FOR PRODUCTION -- READ BEFORE DEPLOYING -- TRUSTED_PROXIES
|
|
; ============================================================================
|
|
; Trusted reverse proxy IPs, comma-separated -- e.g. the Authelia/nginx proxy.
|
|
; Set this to the IP address(es) of your reverse proxy. Authelia forward-auth
|
|
; headers (Remote-User / Remote-Groups) and forwarded client IPs are only
|
|
; trusted when REMOTE_ADDR is in this list.
|
|
;
|
|
; Leaving this EMPTY disables reverse-proxy verification entirely: the app then
|
|
; trusts Remote-User / Remote-Groups headers from ANY source. If the PHP
|
|
; backend is reachable directly -- a misconfigured firewall rule, a container
|
|
; network accidentally exposing the port, SSRF from another internal service
|
|
; -- ANYONE can set Remote-User: admin themselves and fully impersonate any
|
|
; user, including an admin, with ZERO authentication. Only leave it empty when
|
|
; network topology guarantees PHP is reachable solely via the trusted proxy
|
|
; (e.g. local development), never in a real deployment.
|
|
;
|
|
; Exact IP match only (no CIDR). Example (single proxy): TRUSTED_PROXIES=10.10.10.27
|
|
; Example (multiple): TRUSTED_PROXIES=10.10.10.27,10.10.10.28
|
|
; ============================================================================
|
|
TRUSTED_PROXIES=
|
|
|
|
; Timezone (default: America/New_York)
|
|
TIMEZONE=America/New_York
|
|
|
|
; LDAP / lldap (for user avatar lookups)
|
|
LDAP_ENABLED=true
|
|
LDAP_HOST=10.10.10.39
|
|
LDAP_PORT=3890
|
|
LDAP_BIND_DN="uid=tinker-tickets,ou=people,dc=example,dc=com"
|
|
LDAP_BIND_PW=
|
|
LDAP_BASE_DN="dc=example,dc=com"
|
|
LDAP_USER_BASE="ou=people,dc=example,dc=com"
|
|
; How long to cache avatar images locally (seconds, default 3600)
|
|
AVATAR_CACHE_TTL=3600
|