Graham McIntire
0f2195ef9d
Some checks failed
Build and Push / Build and Push Docker Image (push) Failing after 2s
- Content-Security-Policy: nonce-based per-request plug replacing unsafe-inline scripts - RemoteIp: CIDR-based trust gating via InetCidr, skips forwarded headers from untrusted peers - Rate limiting: auth pipeline (20/min), LiveView event handlers, existing mobile channel limits - NetworkPolicy: 4 k8s policies (web ingress, cluster, metrics, egress) for least-privilege networking - PartitionManager: deadlock retry with exponential backoff in drop_partition - Tests: reduced parallelism (max_cases 4), packets_test async:false to prevent trigger contention - k8s: APRS_PASSWORD -> APRS_PASSCODE secretRef, vendor/aprs submodule hardened
61 lines
1.8 KiB
Elixir
61 lines
1.8 KiB
Elixir
import Config
|
|
|
|
# For production, don't forget to configure the url host
|
|
# to something meaningful, Phoenix uses this information
|
|
# when generating URLs.
|
|
|
|
# Note we also include the path to a cache manifest
|
|
# containing the digested version of static files. This
|
|
# manifest is generated by the `mix phx.digest` task,
|
|
# which you should run after static files are built and
|
|
# before starting your production server.
|
|
config :aprsme, AprsmeWeb.Endpoint,
|
|
# Runtime production configuration, including reading
|
|
cache_static_manifest: "priv/static/cache_manifest.json",
|
|
adapter: Bandit.PhoenixAdapter,
|
|
http: [ip: {0, 0, 0, 0}, port: 4000],
|
|
session_options: [
|
|
signing_salt: "aprs-me-production-session-signing-v1",
|
|
encryption_salt: "aprs-me-production-session-encryption-v1",
|
|
secure: true,
|
|
http_only: true,
|
|
same_site: "Lax"
|
|
],
|
|
force_ssl: [rewrite_on: [:x_forwarded_proto], hsts: true]
|
|
|
|
# RemoteIp plug: trust Cloudflare proxy IPs in production.
|
|
# https://www.cloudflare.com/ips/
|
|
config :aprsme, AprsmeWeb.Plugs.RemoteIp,
|
|
trusted_proxies: [
|
|
# Cloudflare IPv4
|
|
"173.245.48.0/20",
|
|
"103.21.244.0/22",
|
|
"103.22.200.0/22",
|
|
"103.31.4.0/22",
|
|
"141.101.64.0/18",
|
|
"108.162.192.0/18",
|
|
"190.93.240.0/20",
|
|
"188.114.96.0/20",
|
|
"197.234.240.0/22",
|
|
"198.41.128.0/17",
|
|
"162.158.0.0/15",
|
|
"104.16.0.0/13",
|
|
"104.24.0.0/14",
|
|
"172.64.0.0/13",
|
|
"131.0.72.0/22",
|
|
# Cloudflare IPv6
|
|
"2400:cb00::/32",
|
|
"2606:4700::/32",
|
|
"2803:f800::/32",
|
|
"2405:b500::/32",
|
|
"2405:8100::/32",
|
|
"2a06:98c0::/29",
|
|
"2c0f:f248::/32"
|
|
]
|
|
|
|
# Do not print debug messages in production
|
|
# of environment variables, is done on config/runtime.exs.
|
|
config :logger, level: :info
|
|
|
|
# Configures Swoosh API Client
|
|
config :swoosh, :api_client, Swoosh.ApiClient.Req
|