tillandClaude Opus 5
4ff9f8b7a0
- CI pinned Node 20, but `node --test` with type stripping needs 22.6, so the workflow could never have gone green. CI and `engines` now say 22.6. - `docker compose up -d` failed on the documented path: the compose files require DB_PASSWORD and .env.example never mentioned it. Documented, and the README no longer claims "three secrets". - The secret scanner treated any comment line as safe, so a pasted `.env` fragment — the usual way a key gets committed — slipped through. Verified against planted keys before and after. - Module pages were not guarded: with KLARBILD_MODULES=print a signed-in user could still open /shares, /library and /queue and read about features the instance does not have. They now redirect, matching the API's 404 behaviour. - German left in the English build: `bild.<ext>` as a download fallback, and 31 t() keys with no German at all — the whole main navigation among them, so a German instance rendered its nav in English. Dictionary now covers every key in the source (1,067 entries). - Third-party names removed from the data as well as the labels: the `theframe` format id is now `tv169`, and the dead Cricut admin field is gone. - Dockerfile ignored the committed lockfile; it now copies it and uses `npm ci`. - Dropped an unused dependency (@aws-sdk/s3-request-presigner — storage.ts explains why presigned URLs are not needed), a dead `/g/` entry in the unauthenticated path list, and an undocumented N8N_WEBHOOK_URL that nothing read. Documented TRUSTED_PROXIES, which the rate limiter does read. - Migration 004 still had "nas" in its filename; README said A6–A2 where the list runs A6–A1; two committed screenshots were referenced nowhere. 124 tests green, type check clean, build clean, secret scan clean. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nh4A79bbqT9dcd2inzYUdg
126 lines
7.5 KiB
Bash
126 lines
7.5 KiB
Bash
# Klarbild — configuration
|
|
#
|
|
# Copy to .env and fill in. Never commit the real file.
|
|
# Everything below the first block is optional: Klarbild starts, and the print
|
|
# studio works, with nothing but a database, SESSION_SECRET and ENCRYPTION_KEY.
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 1. The minimum — this is all a print-only instance needs
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
# The compose files build DATABASE_URL from DB_PASSWORD, so with Docker you set
|
|
# only the password here. Running from source, set DATABASE_URL yourself instead.
|
|
DB_PASSWORD=CHANGEME
|
|
DATABASE_URL=postgres://klarbild:CHANGEME@db:5432/klarbild
|
|
|
|
# Signs the session cookie. Any long random string.
|
|
# openssl rand -base64 48
|
|
SESSION_SECRET=
|
|
|
|
# Encrypts the credentials Klarbild stores in the database (SMTP password,
|
|
# delivery password, API keys). Exactly 32 bytes as 64 hex characters.
|
|
# openssl rand -hex 32
|
|
# Losing this means losing those stored credentials — they cannot be recovered,
|
|
# only re-entered.
|
|
ENCRYPTION_KEY=
|
|
|
|
# Where finished files live. `fs` writes to a volume and needs nothing else;
|
|
# `s3` talks to MinIO or any S3-compatible store (see section 7).
|
|
STORAGE_DRIVER=fs
|
|
STORAGE_DIR=/data
|
|
|
|
# Which modules are on. `print` is always on, with or without this line.
|
|
# print the print studio alone (default)
|
|
# print,ai,share add image generation and share links
|
|
# all everything
|
|
# See src/lib/modules.ts for the full list: print, ai, delivery, mirror,
|
|
# share, mail, telegram.
|
|
KLARBILD_MODULES=print
|
|
|
|
# Interface language: en (default) or de. Visitors can switch with ?lang=,
|
|
# which sets a cookie; this is only what they get before they choose.
|
|
KLARBILD_LOCALE=en
|
|
|
|
# Timezone for the timestamp in generated file names.
|
|
KLARBILD_TZ=Europe/Berlin
|
|
|
|
PORT=4321
|
|
|
|
# How many reverse proxies sit in front of this instance. The rate limiter reads
|
|
# the client address that many hops from the right of X-Forwarded-For, so a wrong
|
|
# number here lets a client either spoof its address or share someone else's
|
|
# limit. One proxy (Caddy, nginx, Traefik, Coolify) is the default.
|
|
TRUSTED_PROXIES=1
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 2. First start
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# The first boot creates exactly one administrator. Set these and it uses them;
|
|
# leave them empty and Klarbild generates a password and prints it once to the
|
|
# server log. There are no other built-in accounts.
|
|
|
|
ADMIN_USERNAME=admin
|
|
ADMIN_PASSWORD=
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 3. Public address
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Needed for share links and for the Telegram webhook. Behind a reverse proxy
|
|
# this is the address the browser sees, not the container port.
|
|
|
|
PUBLIC_BASE_URL=http://localhost:4321
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 4. Module: ai — image generation
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Klarbild calls image models through OpenRouter. This costs money per image.
|
|
# The key can also be entered in the admin area; the database value wins.
|
|
|
|
OPENROUTER_API_KEY=
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 5. Module: mail
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# Klarbild sends through your own mailbox rather than a delivery service, so
|
|
# SPF and DKIM are already right and no third party reads along. These values
|
|
# apply until something is entered under Admin → Email, which then takes over.
|
|
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_SECURE=false
|
|
SMTP_USER=
|
|
SMTP_PASSWORD=
|
|
SMTP_FROM=
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 6. Module: delivery — push finished files to a server you already have
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# The target itself (host, protocol, user, password) is configured in the admin
|
|
# area, because the password belongs in the encrypted settings row, not here.
|
|
# This is only the folder used when nothing more specific is set.
|
|
|
|
DELIVERY_DEFAULT_FOLDER=klarbild
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 7. Module: telegram
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# A bot token from @BotFather. The webhook registers itself after deploy and
|
|
# needs PUBLIC_BASE_URL to be reachable from the internet.
|
|
|
|
TELEGRAM_BOT_TOKEN=
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# 8. S3 / MinIO — only when STORAGE_DRIVER=s3
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
|
|
S3_ENDPOINT=http://minio:9000
|
|
S3_REGION=us-east-1
|
|
S3_BUCKET=klarbild
|
|
S3_ACCESS_KEY=
|
|
S3_SECRET_KEY=
|
|
S3_FORCE_PATH_STYLE=true
|
|
|
|
# A webhook that fires when a job finishes — for n8n and the like — is set in the
|
|
# admin area rather than here, because it is a per-instance setting rather than a
|
|
# secret.
|