7788c74cfe
- Updated the .env.example file to reflect a development environment setup with enhanced secret key requirements and local host settings. - Modified the Docker Compose configuration to enhance security with read-only settings and no-new-privileges options. - Updated requirements.txt to pin package versions for better dependency management. - Enhanced the FastAPI application to include dynamic OpenAPI and documentation URLs based on the environment. - Implemented session versioning in JWT tokens to improve security and user session management. - Added new validation for user roles and password strength in schemas. - Improved email sending logic to handle recipient lists more robustly and added logging for SMTP operations. - Updated dashboard and profile templates to reflect new features and improve user experience.
35 lines
1.3 KiB
Python
35 lines
1.3 KiB
Python
import sys
|
||
|
||
from app.core.config import settings
|
||
|
||
_WEAK_SECRET_KEYS = frozenset(
|
||
{
|
||
"change-me-in-production",
|
||
"please_change_to_a_long_random_secret",
|
||
"secret",
|
||
"changeme",
|
||
}
|
||
)
|
||
_WEAK_BOOTSTRAP_PASSWORDS = frozenset({"changeme123!", "change_me_123", "admin123!"})
|
||
|
||
|
||
def validate_startup_config() -> None:
|
||
errors: list[str] = []
|
||
|
||
if settings.environment.lower() == "production":
|
||
if settings.secret_key.lower() in _WEAK_SECRET_KEYS or len(settings.secret_key) < 32:
|
||
errors.append("SECRET_KEY muss in Produktion mindestens 32 Zeichen lang und zufällig sein.")
|
||
if settings.admin_bootstrap_password.lower() in _WEAK_BOOTSTRAP_PASSWORDS:
|
||
errors.append("ADMIN_BOOTSTRAP_PASSWORD ist zu schwach für Produktion.")
|
||
if settings.admin_bootstrap_reset:
|
||
errors.append("ADMIN_BOOTSTRAP_RESET darf in Produktion nicht aktiv sein.")
|
||
if settings.allowed_hosts.strip() == "*":
|
||
errors.append("ALLOWED_HOSTS darf in Produktion nicht '*' sein – konkrete Hostnamen setzen.")
|
||
if not settings.cookie_secure:
|
||
errors.append("COOKIE_SECURE muss in Produktion auf true gesetzt sein (HTTPS/TLS-Terminierung).")
|
||
|
||
if errors:
|
||
for message in errors:
|
||
print(f"STARTUP-FEHLER: {message}", file=sys.stderr)
|
||
sys.exit(1)
|