Dominik Dachs
88ef0d6943
Secrets (S3 keys, PG password, DeerMapper API key) were committed in config.yaml and .env and remain in git history. This removes them from the tracked tree and moves all secrets to env injection. Security: - config.yaml: drop all credentials, keep only non-secret app tunables - untrack .env, add .env.example template; .gitignore excludes .env - main.py: tolerant config lookups + fail-fast validation for missing secrets - docker-compose: env_file injection, no full-repo bind mount, debug port off - Dockerfile: bake config into image, run as non-root user Efficiency: - OCR: run the second (expensive) tesseract pass only when the first is unparsable; identical fallback behavior Docs: - README with operation + security notes - MIGRATION.md runbook: secret rotation, server cutover, decommission, git history purge Note: the leaked secrets are compromised and MUST be rotated; removing them from the tree is not sufficient. See MIGRATION.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
1.3 KiB
YAML
42 lines
1.3 KiB
YAML
# config.yaml - Nicht-geheime Konfiguration (App-Tunables + oeffentliche Endpunkte).
|
|
#
|
|
# WICHTIG: Hier gehoeren KEINE Zugangsdaten hinein.
|
|
# Secrets kommen ausschliesslich aus Umgebungsvariablen (.env):
|
|
# S3_ACCESS_KEY, S3_SECRET_KEY, PG_DSN, DEERMAPPER_API_KEY
|
|
# (optional koennen auch S3_ENDPOINT / S3_BUCKET / DEERMAPPER_API_URL per ENV
|
|
# ueberschrieben werden.)
|
|
|
|
s3:
|
|
endpoint: "https://fsn1.your-objectstorage.com/"
|
|
bucket: "trapper-meles"
|
|
# access_key / secret_key -> via ENV (.env): S3_ACCESS_KEY / S3_SECRET_KEY
|
|
|
|
postgres: {}
|
|
# dsn -> via ENV (.env): PG_DSN (inkl. ?sslmode=require)
|
|
|
|
deermapper-api:
|
|
base_url: "https://webapp.deermapper.net/api/icu"
|
|
# apiKey -> via ENV (.env): DEERMAPPER_API_KEY
|
|
|
|
app:
|
|
entrance_prefix: "icu/entrance/"
|
|
processed_prefix: "icu/processed/"
|
|
thumb_prefix: "icu/thumbnails/"
|
|
min_age_seconds: 90
|
|
poll_seconds: 30
|
|
# OCR crop tunables (defaults are usually fine)
|
|
ocr_crop_w_frac: 0.63
|
|
ocr_crop_h_frac: 0.05
|
|
thumb_max: 512
|
|
exiftool_timeout_seconds: 15
|
|
job_sleep_seconds: 0.0
|
|
parallel_workers: 6
|
|
s3_max_pool_connections: 48
|
|
# Optional processing switches:
|
|
# - false => image still gets moved + thumbnail, and backfill flag is set in import_job
|
|
enable_ocr: true
|
|
enable_exif: true
|
|
enable_deermapper_api: false
|
|
deermapper_api_timeout_seconds: 20
|
|
deermapper_api_image_field: "image"
|