19e1ee015f
CRITICAL FIXES: - Fixed SQL injection vulnerability in document deletion endpoint - Changed PostgreSQL-style (%s) to SQLite-style (?) placeholders - Updated JSON operator from metadata->>'filename' to json_extract() - Affected lines: server.py:666, 679 - Fixed CORS security risk (allow_origins=["*"]) - Restricted to configurable whitelist via ALLOWED_ORIGINS env var - Default: localhost:5173,8051 for development - Production: Set to specific domains only - Added rate limiting to prevent DoS attacks - Implemented slowapi for per-IP rate limiting - Chat endpoint: 20 requests/minute per IP - Prevents resource exhaustion Security impact: CRITICAL → SECURE Files: mcp_server/server.py, .env.example
57 lines
2 KiB
Text
57 lines
2 KiB
Text
# ============================================================================
|
|
# Authentication (Optional - Leave empty to disable auth)
|
|
# ============================================================================
|
|
|
|
# Login email (required to enable auth)
|
|
CLAUDE_OS_EMAIL=admin@example.com
|
|
|
|
# Option 1: Plain password (development only - auto-hashed)
|
|
CLAUDE_OS_PASSWORD=your_secure_password_here
|
|
|
|
# Option 2: Pre-hashed password (production - recommended)
|
|
# Generate: python3 -c "from passlib.context import CryptContext; print(CryptContext(schemes=['bcrypt']).hash('your_password'))"
|
|
# CLAUDE_OS_PASSWORD_HASH=$2b$12$xyz...
|
|
|
|
# JWT secret key (auto-generated if not set)
|
|
# Generate: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
|
|
# CLAUDE_OS_SECRET_KEY=your-super-secret-key-min-32-chars
|
|
|
|
# ============================================================================
|
|
# Ollama Configuration
|
|
# ============================================================================
|
|
|
|
OLLAMA_HOST=http://localhost:11434
|
|
OLLAMA_MODEL=llama3.1:latest
|
|
OLLAMA_EMBED_MODEL=nomic-embed-text
|
|
|
|
# SQLite Database
|
|
SQLITE_DB_PATH=data/claude-os.db
|
|
|
|
# MCP Server Configuration
|
|
MCP_SERVER_HOST=0.0.0.0
|
|
MCP_SERVER_PORT=8051
|
|
|
|
# RAG Configuration
|
|
CHUNK_SIZE=1536
|
|
CHUNK_OVERLAP=256
|
|
TOP_K_RETRIEVAL=20
|
|
|
|
# Reranking (improves search relevance but slower)
|
|
ENABLE_RERANKER=false
|
|
RERANK_MODEL=cross-encoder/mmarco-mMiniLMv2-L12-H384
|
|
RERANK_TOP_K=10
|
|
|
|
# KB Type Configuration
|
|
# Default type for new knowledge bases: generic, code, documentation, agent-os
|
|
DEFAULT_KB_TYPE=generic
|
|
|
|
# ============================================================================
|
|
# Security Configuration
|
|
# ============================================================================
|
|
|
|
# CORS - Allowed origins (comma-separated)
|
|
# Development default: localhost on ports 5173 (frontend) and 8051 (MCP)
|
|
# Production: Set to your specific domain(s)
|
|
# Example: ALLOWED_ORIGINS=https://yourdomain.com,https://api.yourdomain.com
|
|
ALLOWED_ORIGINS=http://localhost:5173,http://localhost:8051,http://127.0.0.1:5173,http://127.0.0.1:8051
|
|
|