Jonathan
8cd5392ec3
.env.example shipped a valid, PUBLIC base64 key — if a user didn't replace it, every credential got encrypted with a publicly-known key and everything still "worked," so the footgun was silent. - .env.example now ships an obvious placeholder (CHANGE_ME_generate_with_...) with a "you MUST replace this" note and the openssl hint. - web + worker validate LYRA_SECRET_KEY at startup: missing / placeholder / wrong-length ⇒ loud FATAL banner and refuse to start (web via the Next.js instrumentation hook, worker via _require_secret_key before touching the DB). The old public example key ⇒ a loud WARNING but not fatal, since an existing install may have encrypted its creds under it (rotating needs re-entry). - Validation lives in an edge-safe web/src/lib/secret-key.ts (no node:crypto) so the instrumentation hook bundles for both runtimes; crypto.ts re-exports. - README emphasizes generating a fresh key + keeping it stable. Verified live: worker exits 1 on placeholder/unset before any DB call; web instrumentation throws and refuses to serve on the placeholder. web 138 tests, worker 204/7-skip, tsc clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
39 lines
2.0 KiB
Bash
39 lines
2.0 KiB
Bash
POSTGRES_USER=lyra
|
|
POSTGRES_PASSWORD=lyra
|
|
POSTGRES_DB=lyra
|
|
DATABASE_URL=postgresql://lyra:lyra@db:5432/lyra
|
|
|
|
# Encryption key for stored credentials — 32 random bytes, base64. YOU MUST REPLACE THIS.
|
|
# Generate your own: openssl rand -base64 32
|
|
# Leaving the placeholder (or an empty key) makes web + worker refuse to start.
|
|
LYRA_SECRET_KEY=CHANGE_ME_generate_with_openssl_rand_base64_32
|
|
|
|
# Shared password protecting the whole web UI + API. When set, every request must sign in
|
|
# (one shared password, no per-user accounts). LEAVE UNSET AND THE APP IS OPEN to anyone
|
|
# who can reach the host — only safe on a trusted LAN or behind a VPN/auth proxy. Strongly
|
|
# recommended for any exposed deployment. See README "Security".
|
|
# LYRA_PASSWORD=change-me
|
|
|
|
# Host directory for the downloaded music library (bind-mounted into the worker at /music)
|
|
MUSIC_DIR=./music
|
|
|
|
# Host directory for per-job download staging (bind-mounted into the worker at /staging).
|
|
# Defaults to MUSIC_DIR/.staging. Point this at a fast LOCAL disk when MUSIC_DIR is a network
|
|
# share (SMB/NFS) so temporary downloads don't hammer the share; the final import copies the
|
|
# finished album onto the library volume and swaps it in atomically.
|
|
# STAGING_DIR=/srv/lyra-staging
|
|
|
|
# Host directory where slskd (the external Soulseek daemon) writes FINISHED downloads,
|
|
# bind-mounted into the worker at /slskd-downloads. The worker moves completed Soulseek
|
|
# transfers out of here into staging, so this MUST be the same directory slskd downloads to.
|
|
# Set this only once Lyra runs on the same host as slskd; until then Soulseek can search but
|
|
# not deliver. Defaults to ./slskd-downloads (an empty local dir) so the stack still starts.
|
|
# SLSKD_DOWNLOADS_DIR=/var/lib/slskd/downloads
|
|
|
|
# Postgres backups (db-backup sidecar). Dumps go to BACKUP_DIR on the host; the sidecar
|
|
# keeps the last BACKUP_KEEP dumps and runs every BACKUP_INTERVAL_SECONDS (default daily).
|
|
# Point BACKUP_DIR at a NAS/synced path for off-box safety. See README "Backup & restore".
|
|
# BACKUP_DIR=./backups
|
|
# BACKUP_INTERVAL_SECONDS=86400
|
|
# BACKUP_KEEP=7
|