JakeBreath
16907c39ca
- django-cors-headers with env-driven CORS_ALLOWED_ORIGINS, CORS_ALLOW_ALL_ORIGINS, CORS_ALLOW_CREDENTIALS and CSRF_TRUSTED_ORIGINS; same-origin traffic is unaffected and a disallowed origin gets no CORS headers. Token auth needs no cookies, so credentials stay off by default. - TRUST_PROXY_HEADERS=true lets a TLS-terminating proxy supply X-Forwarded-Proto/Host for correct absolute URLs. - API media URLs (raw/thumbnail/upload/similarity/staged previews) are now absolute, built from the request host, so <img>/<video>/fetch() keep working when the SPA is served from another origin. Signed URLs are still per-user; nothing is stored in the DB. - The SPA gains VITE_API_BASE (build-time, empty = same-origin) applied by a small apiUrl() helper used for XHR/fetch and the few URL fallbacks. Verified with a throwaway instance: preflight and GET responses carry the allowed origin, foreign origins get nothing, media GETs include CORS for cross-origin fetch(), and payload URLs use the request host (dev :8000 unchanged).
37 lines
1.2 KiB
Bash
37 lines
1.2 KiB
Bash
SECRET_KEY=change-me-to-a-long-random-string
|
|
DEBUG=True
|
|
ALLOWED_HOSTS=localhost,127.0.0.1
|
|
|
|
# Cross-origin frontends (comma separated). Same-origin keeps working with an
|
|
# empty list; add e.g. https://j621.example.com when the SPA is served from
|
|
# another origin than this API.
|
|
# CORS_ALLOWED_ORIGINS=https://j621.example.com
|
|
# CORS_ALLOW_ALL_ORIGINS=false
|
|
# CORS_ALLOW_CREDENTIALS=false
|
|
# CSRF_TRUSTED_ORIGINS=https://j621.example.com
|
|
# Trust X-Forwarded-Proto/Host from a TLS-terminating reverse proxy so media
|
|
# URLs keep https and the public hostname.
|
|
# TRUST_PROXY_HEADERS=true
|
|
|
|
# Absolute path to your media folder, or relative to the backend/ folder.
|
|
WATCHED_FOLDER=media/library
|
|
|
|
# MariaDB (docker compose at the repo root)
|
|
DB_HOST=127.0.0.1
|
|
DB_PORT=3307
|
|
DB_NAME=j621
|
|
DB_USER=j621
|
|
DB_PASSWORD=j621
|
|
|
|
# Redis (docker compose at the repo root)
|
|
REDIS_URL=redis://127.0.0.1:6380/1
|
|
|
|
# Guest visibility: e621's anonymous default blacklist is mirrored into
|
|
# Redis by `manage.py refresh_guest_blacklist`.
|
|
# GUEST_BLACKLIST_FALLBACK=young,cub,shota,loli,child,underage
|
|
# GUEST_BLACKLIST_TTL=3600
|
|
|
|
# Ephemeral similarity checks: temp files are wiped on startup and after
|
|
# this many minutes.
|
|
# SIMILARITY_TTL_MINUTES=30
|