a2nr
/
elemes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
elemes/.env.example

48 lines
2.1 KiB
Plaintext
Raw Normal View History

feat: add conditional directory creation for assets and state folders with status logging
2026-04-11 09:48:33 +07:00
# ============================================================
# LMS Configuration
# ============================================================
feat: Add initial configuration files, example content, and lesson materials for programming and circuit in Elemes LMS
2026-04-01 09:37:09 +07:00
# ── Identitas LMS ──────────────────────────────
# Variabel ini tampil di frontend (navbar, footer, title)
feat: add conditional directory creation for assets and state folders with status logging
2026-04-11 09:48:33 +07:00
APP_BAR_TITLE=LMS elemes DEVELOPMENT TEST
COPYRIGHT_TEXT=Nama Sekolah @ 2026
PAGE_TITLE_SUFFIX=LMS elemes DEVELOPMENT TEST
CURSOR_OFFSET_Y=50
feat: Add initial configuration files, example content, and lesson materials for programming and circuit in Elemes LMS
2026-04-01 09:37:09 +07:00
feat: add conditional directory creation for assets and state folders with status logging
2026-04-11 09:48:33 +07:00
# ── Konfigurasi Internal Backend ───────────────
# Penamaan folder & file ini dipakai didalam lingkup container
feat: Add initial configuration files, example content, and lesson materials for programming and circuit in Elemes LMS
2026-04-01 09:37:09 +07:00
CONTENT_DIR=content
security: implement gVisor sandboxing and harden API endpoints - Menambahkan service 'compiler-worker' terpisah untuk isolasi eksekusi kode C/Python. - Mengintegrasikan gVisor (runsc) pada worker untuk mencegah RCE pada level kernel. - Menggunakan Gunicorn (4 workers) pada compiler-worker untuk mendukung concurrency. - Menambahkan otentikasi token wajib pada endpoint /compile dan laporan progres. - Memperketat CORS policy menggunakan environment variable ORIGIN. - Menerapkan secure_filename pada rute pelajaran untuk mencegah Path Traversal. - Mengubah volume mounting backend utama menjadi Read-Only (:ro) untuk perlindungan data. - Memperbarui proposal.md dan .env.example dengan standar keamanan terbaru.
2026-04-21 15:13:16 +07:00
# Domain frontend yang diizinkan untuk CORS (misal: http://localhost:3000)
ORIGIN=http://localhost:3000
feat(security): implement anonymous access with rate limiting and secure proxy, harden authentication and implement session protection Implements multiple layers of security to address high-risk session and authentication vulnerabilities identified in the security review: - Allow code compilation (C, Python, Arduino) for anonymous users. - Enforce a 1-request-per-2-minutes rate limit for anonymous IPs. - Implement a global anonymous compilation queue with 20 concurrent slots. - Proxy Velxio (Arduino) compilation through Flask to prevent API hijacking. - Exempt authenticated users (tokens/cookies) from all rate limits. - Fix networking and DNS resolution in podman-compose. - Fix Svelte a11y warnings and trailing slash routing issues. - Cookie Security: Added dynamic 'secure' flag support via COOKIE_SECURE env variable for HTTPS/Tailscale Funnel compatibility. - Rate Limiting: Integrated Flask-Limiter on /login (50 req/min) to prevent API abuse while accommodating shared school networks (NAT). - Tarpitting: Added 1.5s artificial delay on failed logins to neutralize automated brute-force tools without blocking legitimate users. - Session Invalidation: Implemented an in-memory token blacklist on logout to ensure session tokens cannot be reused. - Documentation: Updated technical docs and proposal status to reflect the current security architecture. Ref: @elemes/proposal.md (Poin 6.1, 6.2, 6.3)
2026-04-22 12:57:54 +07:00
COOKIE_SECURE=false
security: implement gVisor sandboxing and harden API endpoints - Menambahkan service 'compiler-worker' terpisah untuk isolasi eksekusi kode C/Python. - Mengintegrasikan gVisor (runsc) pada worker untuk mencegah RCE pada level kernel. - Menggunakan Gunicorn (4 workers) pada compiler-worker untuk mendukung concurrency. - Menambahkan otentikasi token wajib pada endpoint /compile dan laporan progres. - Memperketat CORS policy menggunakan environment variable ORIGIN. - Menerapkan secure_filename pada rute pelajaran untuk mencegah Path Traversal. - Mengubah volume mounting backend utama menjadi Read-Only (:ro) untuk perlindungan data. - Memperbarui proposal.md dan .env.example dengan standar keamanan terbaru.
2026-04-21 15:13:16 +07:00
COMPILER_WORKER_URL=http://compiler-worker:8080/execute
feat: Add initial configuration files, example content, and lesson materials for programming and circuit in Elemes LMS
2026-04-01 09:37:09 +07:00
feat: add conditional directory creation for assets and state folders with status logging
2026-04-11 09:48:33 +07:00
# ── Tailscale (opsional, untuk jaringan P2P) ───
ELEMES_HOST=sinau-c-hostname-kamu
feat: Add initial configuration files, example content, and lesson materials for programming and circuit in Elemes LMS
2026-04-01 09:37:09 +07:00
TS_AUTHKEY=tskey-auth-xxxx
feat: add conditional directory creation for assets and state folders with status logging
2026-04-11 09:48:33 +07:00
# ── Flask (opsional: untuk dev mode lokal) ─────
FLASK_DEBUG=false
feat(storage): migrasi penyimpanan CSV ke PostgreSQL (SQLAlchemy + Alembic) - facade storage: csv_backend + postgres_backend, dipilih via STORAGE_BACKEND - token disimpan sebagai HMAC-SHA256 digest (TOKEN_PEPPER), tanpa plaintext - schema alembic 0001: users, access_tokens, lessons, student_progress - importer CSV idempotent + dry-run + sparse model (not_started tanpa row) - lesson registry: sync dari home.md (lesson hilang di-deactivate, bukan dihapus) - routes progress/auth: report & reset via DB, validasi via token hash - elemes.sh: dbupgrade/dbstatus/dbimport/synclessons/dbverify/dbbackup/dbrestore/dbexport - podman-compose: service postgres (PG18), tokens_siswa.csv mount :ro - frontend: api client + progress page; tests kontrak dual-backend + isolasi DB - load-test: skenario database (locustfile_db.py) - docs: 01-11 termasuk 11-database-migration.md (arsitektur & operasional)
2026-08-08 11:57:08 +07:00
# ── PostgreSQL (source of truth sejak migrasi CSV→DB) ──
POSTGRES_DB=elemes
POSTGRES_USER=elemes
# WAJIB diganti dengan password kuat (huruf/angka saja agar aman di URL)
POSTGRES_PASSWORD=elemes_pg_dev_password
# URL koneksi SQLAlchemy (psycopg 3 driver)
DATABASE_URL=postgresql+psycopg://elemes:elemes_pg_dev_password@127.0.0.1:5432/elemes
# Pepper untuk HMAC digest token — WAJIB unik & dibackup; hilang = semua token invalid
TOKEN_PEPPER=ganti_dengan_pepper_acak_panjang
feat(teacher): manajemen akun guru canonical + first-run otomatis; cabut backend CSV (PG only) - feat: ./elemes.sh teacher — upsert satu akun guru canonical (prompt nama default TEACHER_NAME, token tersembunyi via stdin, rotasi token saat guru sudah ada, idempotent); TEACHER_NAME/TEACHER_TOKEN di .env - feat: first-run otomatis — db_init jalankan alembic upgrade head + bootstrap guru bila TEACHER_TOKEN terisi (run/runbuild/runclearbuild) - refactor: backend CSV dicabut penuh — hapus mount tokens_siswa.csv, TOKENS_FILE, STORAGE_BACKEND=csv, csv_backend.py, csv_importer.py, generate_tokens.py, script migrate/verify/export CSV, command generatetoken/dbimport/dbverify/dbexport/synclessons; storage fail-loud postgresql-only - fix: dbrestore gagal diam-diam saat restore ke DB berisi data (dump tanpa --clean) — dbbackup kini --clean --if-exists + dbrestore reset schema public; roundtrip terverifikasi - test: suite kontrak PG-native + route auth/progress integrasi PG; 183 passed container, 96 passed host, frontend 91 passed - docs: README, documentation.md, docs/01/02/11, load-test/README disinkronkan ke realita PostgreSQL-only; proposal.md dipertahankan (historis) - chore: load-test token sintetis di-seed ke PG (content_parser), config.py bersih TOKENS_FILE, .dockerignore/.gitignore dibersihkan
2026-08-09 11:21:08 +07:00
# Storage aktif: satu-satunya backend adalah postgresql (backend CSV sudah dicabut)
feat(storage): migrasi penyimpanan CSV ke PostgreSQL (SQLAlchemy + Alembic) - facade storage: csv_backend + postgres_backend, dipilih via STORAGE_BACKEND - token disimpan sebagai HMAC-SHA256 digest (TOKEN_PEPPER), tanpa plaintext - schema alembic 0001: users, access_tokens, lessons, student_progress - importer CSV idempotent + dry-run + sparse model (not_started tanpa row) - lesson registry: sync dari home.md (lesson hilang di-deactivate, bukan dihapus) - routes progress/auth: report & reset via DB, validasi via token hash - elemes.sh: dbupgrade/dbstatus/dbimport/synclessons/dbverify/dbbackup/dbrestore/dbexport - podman-compose: service postgres (PG18), tokens_siswa.csv mount :ro - frontend: api client + progress page; tests kontrak dual-backend + isolasi DB - load-test: skenario database (locustfile_db.py) - docs: 01-11 termasuk 11-database-migration.md (arsitektur & operasional)
2026-08-08 11:57:08 +07:00
STORAGE_BACKEND=postgresql
feat(teacher): manajemen akun guru canonical + first-run otomatis; cabut backend CSV (PG only) - feat: ./elemes.sh teacher — upsert satu akun guru canonical (prompt nama default TEACHER_NAME, token tersembunyi via stdin, rotasi token saat guru sudah ada, idempotent); TEACHER_NAME/TEACHER_TOKEN di .env - feat: first-run otomatis — db_init jalankan alembic upgrade head + bootstrap guru bila TEACHER_TOKEN terisi (run/runbuild/runclearbuild) - refactor: backend CSV dicabut penuh — hapus mount tokens_siswa.csv, TOKENS_FILE, STORAGE_BACKEND=csv, csv_backend.py, csv_importer.py, generate_tokens.py, script migrate/verify/export CSV, command generatetoken/dbimport/dbverify/dbexport/synclessons; storage fail-loud postgresql-only - fix: dbrestore gagal diam-diam saat restore ke DB berisi data (dump tanpa --clean) — dbbackup kini --clean --if-exists + dbrestore reset schema public; roundtrip terverifikasi - test: suite kontrak PG-native + route auth/progress integrasi PG; 183 passed container, 96 passed host, frontend 91 passed - docs: README, documentation.md, docs/01/02/11, load-test/README disinkronkan ke realita PostgreSQL-only; proposal.md dipertahankan (historis) - chore: load-test token sintetis di-seed ke PG (content_parser), config.py bersih TOKENS_FILE, .dockerignore/.gitignore dibersihkan
2026-08-09 11:21:08 +07:00
# ── Akun Guru (bootstrap canonical) ─────────────
# Nama default guru: dipakai saat first-run otomatis dan sebagai default
# prompt pada `./elemes.sh teacher`.
TEACHER_NAME=Guru LMS
# Token guru untuk first-run non-interaktif (opsional). Jika dibiarkan
# kosong, `./elemes.sh teacher` tetap meminta token secara tersembunyi.
# Token disimpan sebagai HMAC digest — jangan bagikan ke siapa pun.
# Mengubah nilai ini saat guru sudah ada akan MEROTASI token guru lama.
TEACHER_TOKEN=