ignace/lapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

better secrets admin

Browse Source
This commit is contained in:
ignace
2026-07-19 09:58:27 +02:00
parent 768ccab09f
commit 0c03348c88
6 changed files with 118 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+14 -35
View File
@@ -10,45 +10,24 @@ install
## Secrets and configuration
LAPP does not store runtime secrets in the source code. Configure them with
environment variables in production:
LAPP stores its private configuration in `instance/secrets.yaml`. On first
startup, missing values are generated automatically and the file permissions are
set to `0600`.
```sh
export LAPP_SECRET_KEY="replace-with-a-long-random-secret"
export LAPP_APPLICATION_KEY="replace-with-another-long-random-secret"
export LAPP_DATABASE_URI="sqlite:///app.db"
```
The file contains the Flask session key, API application key, database URI,
initial account credentials, initial group secrets, and the Fernet key used by
`test.py`. To change the database, edit `runtime.database_uri` in this file.
`LAPP_SECRET_KEY` signs Flask sessions and auto-login cookies. Keep it stable:
changing it logs users out and invalidates existing auto-login cookies.
Keep `runtime.secret_key` stable: changing it logs users out and invalidates
existing auto-login cookies. `runtime.application_key` is used by
`/api/validate_key`.
`LAPP_APPLICATION_KEY` is used by `/api/validate_key`.
`LAPP_DATABASE_URI` is optional. If it is not set, LAPP uses `sqlite:///app.db`.
For local development, if `LAPP_SECRET_KEY` or `LAPP_APPLICATION_KEY` is not set,
the app creates stable random secrets in:
```text
instance/secret_key
instance/application_key
```
The `instance/` directory is ignored by git, so these generated secrets should
not be committed.
The entire `instance/` directory is ignored by Git. Back up `secrets.yaml`
securely and never commit or share it.
## Initial data secrets
`initialize_data.py` creates initial users and groups only when the database has
no users yet. You can provide the initial passwords and group secrets with:
```sh
export LAPP_INITIAL_ADMIN_PASSWORD="replace-me"
export LAPP_INITIAL_ADMIN_GROUP="replace-me"
export LAPP_INITIAL_USER_PASSWORD="replace-me"
export LAPP_INITIAL_USER_GROUP="replace-me"
./venv/bin/python initialize_data.py
```
If these variables are not set, `initialize_data.py` generates random values and
prints them once when it creates the initial data.
no users yet. Set the values under `initial_data` in `instance/secrets.yaml`
before running it, or use the securely generated defaults. The script prints the
location of the credentials when it creates the initial data.