bvandeusenandClaude Opus 5
8a4af589f1
Build images / sign-extension (push) Successful in 4s
Build images / build-agent (push) Successful in 9s
Build images / build-ml (push) Successful in 29s
Build images / build-web (push) Successful in 23s
CI / lint (push) Successful in 3s
CI / extension-version (push) Successful in 4s
CI / frontend-build (push) Successful in 20s
CI / backend-lint-and-test (push) Successful in 30s
CI / integration (push) Successful in 3m42s
FC has no login — no User model, no session auth, nothing. That was a deliberate call for a single-operator tool and it stays (operator, this session), but it was nowhere in the docs, and the app stores live Patreon / SubscribeStar / Pixiv session cookies on accounts that carry a payment method. Anyone standing this up from the README could reasonably have put it behind a TLS-terminating proxy and considered it handled. So the no-auth posture is now stated three times, in the three places someone decides where to bind the port: README has a "Before you expose it" section above the install instructions, .env.example explains why there is no auth variable in it, and the compose header says it before the first service. SECURITY.md claimed the opposite. It listed "a multi-user sharing ACL — instances can be shared" among the things worth protecting; there are no accounts to share between. That was rule 47 applied to a codebase that does not implement it, and it would have told a researcher FC holds a boundary it does not. Replaced with the real posture, including that TLS without an authenticating layer in front changes nothing. Also corrected, all of it stale rather than wrong-at-the-time: - EXTENSION_API_KEY was dead config. config.py read it into a field nothing consumed; the real key is generated into app_setting on first use and managed in the UI. Removed from config.py, compose and .env.example. - .env.example pointed at docs/superpowers/specs/… — there is no docs/ dir — and described the extension key as "lands in FC-3", closed 2026-05-21. - The /import mount comment described an FC-5 ImageRepo migration run from "Settings → Maintenance → Legacy migration", a surface with no frontend. - README said the extension installs from Settings → Maintenance. It is on Subscriptions → Settings. README is now split: running FC above the line, developing FC below it, with requirements, first run, the extension, upgrading and troubleshooting on the running side. First run documents the one real gap it found — a new installer with a library on disk has no button to import it, only POST /api/import/trigger, because the manual-scan UI was retired 2026-07-02 when that stopped mattering for an established install. Filed as #3367. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017QHszn9H8VBvx5Ke8x1hvw
76 lines
3.1 KiB
Bash
76 lines
3.1 KiB
Bash
# FabledCurator configuration.
|
|
#
|
|
# Copy to `.env` and edit before your first production start:
|
|
#
|
|
# cp .env.example .env
|
|
#
|
|
# Only the two values under CHANGE THESE actually need your attention. The
|
|
# rest have working defaults baked into docker-compose.yml and are listed
|
|
# here so you know they exist, not because you have to set them.
|
|
#
|
|
# Almost nothing else lives here on purpose. FabledCurator is configured from
|
|
# its own Settings UI, backed by the database — no restart, no YAML. If you
|
|
# are looking for where to set an import path, a download schedule or an ML
|
|
# threshold, it is in the app, not in this file.
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# CHANGE THESE
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# The Postgres password. docker-compose.yml falls back to a published default
|
|
# (`fabledcurator_dev`) so that `docker compose up` works with no config at
|
|
# all — which is exactly why you must not leave it at that on a real install.
|
|
# It is the credential protecting your stored platform session cookies.
|
|
DB_PASSWORD=
|
|
|
|
# Sets Quart's app.secret_key. Today it signs nothing: FabledCurator has no
|
|
# login and uses no session cookies, so no value here is protecting anything
|
|
# right now. Set it anyway. It is required at boot rather than defaulted so
|
|
# that the day something session-backed does land, no instance is already
|
|
# running on a value published in this file.
|
|
#
|
|
# openssl rand -hex 32
|
|
SECRET_KEY=
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Optional — defaults are fine
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Host port the UI is published on. The container always listens on 8080;
|
|
# this is only the left-hand side of the port mapping.
|
|
PORT=8080
|
|
|
|
# DEBUG | INFO | WARNING | ERROR
|
|
LOG_LEVEL=INFO
|
|
|
|
# Postgres identity. Change these only if you are pointing at a database you
|
|
# manage yourself — the bundled postgres service is created with whatever is
|
|
# set here, so changing them after the first start will not rename anything.
|
|
DB_USER=fabledcurator
|
|
DB_NAME=fabledcurator
|
|
|
|
# Set by docker-compose.yml to reach the bundled services. Override only when
|
|
# running Postgres or Redis outside this stack.
|
|
# DB_HOST=postgres
|
|
# DB_PORT=5432
|
|
# CELERY_BROKER_URL=redis://redis:6379/0
|
|
# CELERY_RESULT_BACKEND=redis://redis:6379/0
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# There is no authentication variable here, and that is not an omission
|
|
# ---------------------------------------------------------------------------
|
|
#
|
|
# FabledCurator has no login, no accounts and no permission model. Anything
|
|
# that can reach PORT is an administrator and can read the platform session
|
|
# cookies the app stores for Patreon, SubscribeStar and Pixiv.
|
|
#
|
|
# Bind it to a trusted network. See "Before you expose it" in README.md and
|
|
# the deployment posture section of SECURITY.md.
|
|
#
|
|
# The Firefox extension's API key is NOT configured here — it is generated
|
|
# automatically on first use and shown under Settings → Maintenance, where you
|
|
# can also rotate it.
|