John Cardinal
a843bd3132
The LAN/IIS and Linux templates shipped a placeholder secret printed in the manual, and installs that kept it signed logins with a public key; any setting also invited short or reused values (security review F1). The setting is now ignored (one warning at boot if still present): the server generates a key once (48 random bytes) into jwt-signing.key in the data folder (beside the app if there is none; owner-only on Linux) and reuses it, so sign-ins also survive a restart where the server used to make a new key each boot (standalone, Linux desktop). If the file cannot be used, a temporary key is used for that run. Templates and dev launch configs drop the setting; manual updated (key page rewritten, setting steps removed from install pages); changelog line. Checked locally: token forged with the old placeholder 401; key file created and reused after restart (old token 200); auth and 2FA tests pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
7 lines
299 B
JSON
7 lines
299 B
JSON
{
|
|
"AYANOVA_USE_URLS": "http://*:7575",
|
|
"AYANOVA_DB_CONNECTION":"Server=localhost;Username=postgres;Password=YOUR_PASSWORD_HERE;Database=AyaNova;CommandTimeout=300;",
|
|
"AYANOVA_DEFAULT_TRANSLATION":"en",
|
|
"AYANOVA_DATA_PATH":"/var/ayanova/data/",
|
|
"AYANOVA_LOG_LEVEL": "Info"
|
|
} |