mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-02 05:12:11 +03:00
1cbbc33f20
FASE-01 — Security Hardening: - Remove hardcoded JWT_SECRET and API_KEY_SECRET fallbacks (fail-fast) - Create secretsValidator.js with enforceSecrets() at startup - Create inputSanitizer.js (prompt injection + PII detection) - Integrate sanitizer in chat.js handler pipeline - Add structured logging to silent catch blocks in proxy.js - Remove .passthrough() from Zod updateSettingsSchema - Remove insecure npm fs dependency - Update .env.example with generation commands FASE-02 — CI/CD & Tests: - Create ci.yml workflow (lint, build, test, coverage, e2e) - Fix test scripts (test now runs actual tests) - Add test:unit, test:security, test:coverage (c8), test:all - Add security rules to ESLint (no-eval, no-implied-eval, no-new-func) FASE-03 — Architecture: - Create settingsCache.js (eliminate self-fetch anti-pattern) - Create domain/types.js and domain/responses.js FASE-04 — Observability: - Create correlationId.js (AsyncLocalStorage tracing) - Create circuitBreaker.js (full state machine + registry) - Create requestTimeout.js (per-provider timeouts) FASE-05 — Code Quality: - Create structuredLogger.js (JSON/human-readable logging) FASE-06 — Documentation: - Update SECURITY.md with hardening practices - Create CONTRIBUTING.md with dev setup and PR checklist Tests: 52/52 pass (23 security + 15 observability + 14 integration)
116 lines
3.4 KiB
Plaintext
116 lines
3.4 KiB
Plaintext
# OmniRoute environment contract
|
|
# This file reflects actual runtime usage in the current codebase.
|
|
|
|
# ═══════════════════════════════════════════════════
|
|
# REQUIRED SECRETS — Generate strong values!
|
|
# ═══════════════════════════════════════════════════
|
|
# Generate with: openssl rand -base64 48
|
|
JWT_SECRET=
|
|
# Generate with: openssl rand -hex 32
|
|
API_KEY_SECRET=
|
|
|
|
# Initial admin password (change after first login)
|
|
INITIAL_PASSWORD=123456
|
|
DATA_DIR=/var/lib/omniroute
|
|
|
|
# Storage (SQLite)
|
|
STORAGE_DRIVER=sqlite
|
|
# Generate with: openssl rand -hex 32
|
|
STORAGE_ENCRYPTION_KEY=
|
|
STORAGE_ENCRYPTION_KEY_VERSION=v1
|
|
LOG_RETENTION_DAYS=90
|
|
SQLITE_MAX_SIZE_MB=2048
|
|
SQLITE_CLEAN_LEGACY_FILES=true
|
|
|
|
# Recommended runtime variables
|
|
PORT=20128
|
|
NODE_ENV=production
|
|
INSTANCE_NAME=omniroute
|
|
|
|
# Recommended security and ops variables
|
|
MACHINE_ID_SALT=endpoint-proxy-salt
|
|
ENABLE_REQUEST_LOGS=false
|
|
AUTH_COOKIE_SECURE=false
|
|
REQUIRE_API_KEY=false
|
|
|
|
# Input Sanitizer (FASE-01 — prompt injection & PII protection)
|
|
# INPUT_SANITIZER_ENABLED=true
|
|
# INPUT_SANITIZER_MODE=warn # warn | block | redact
|
|
# PII_REDACTION_ENABLED=false
|
|
|
|
# Cloud sync variables
|
|
# Must point to this running instance so internal sync jobs can call /api/sync/cloud.
|
|
# Server-side preferred variables:
|
|
BASE_URL=http://localhost:20128
|
|
CLOUD_URL=
|
|
# Backward-compatible/public variables:
|
|
NEXT_PUBLIC_BASE_URL=http://localhost:20128
|
|
NEXT_PUBLIC_CLOUD_URL=
|
|
|
|
# Optional outbound proxy variables for upstream provider calls
|
|
# Lowercase variants are also supported: http_proxy, https_proxy, all_proxy, no_proxy
|
|
# SOCKS5 proxy support
|
|
ENABLE_SOCKS5_PROXY=true
|
|
NEXT_PUBLIC_ENABLE_SOCKS5_PROXY=true
|
|
# HTTP_PROXY=http://127.0.0.1:7890
|
|
# HTTPS_PROXY=http://127.0.0.1:7890
|
|
# ALL_PROXY=socks5://127.0.0.1:7890
|
|
# NO_PROXY=localhost,127.0.0.1
|
|
|
|
# Optional CLI runtime overrides (Docker/host integration)
|
|
# CLI_MODE=auto
|
|
# CLI_EXTRA_PATHS=/host-cli/bin
|
|
# CLI_CONFIG_HOME=/root
|
|
# CLI_ALLOW_CONFIG_WRITES=true
|
|
# CLI_CLAUDE_BIN=claude
|
|
# CLI_CODEX_BIN=codex
|
|
# CLI_DROID_BIN=droid
|
|
# CLI_OPENCLAW_BIN=openclaw
|
|
# CLI_CURSOR_BIN=agent
|
|
# CLI_CLINE_BIN=cline
|
|
# CLI_ROO_BIN=roo
|
|
# CLI_CONTINUE_BIN=cn
|
|
|
|
# Provider OAuth Credentials (optional — override hardcoded defaults)
|
|
# These can also be set via data/provider-credentials.json
|
|
# CLAUDE_OAUTH_CLIENT_ID=
|
|
# GEMINI_OAUTH_CLIENT_ID=
|
|
# GEMINI_OAUTH_CLIENT_SECRET=
|
|
# GEMINI_CLI_OAUTH_CLIENT_ID=
|
|
# GEMINI_CLI_OAUTH_CLIENT_SECRET=
|
|
# CODEX_OAUTH_CLIENT_ID=
|
|
# CODEX_OAUTH_CLIENT_SECRET=
|
|
# QWEN_OAUTH_CLIENT_ID=
|
|
# IFLOW_OAUTH_CLIENT_ID=
|
|
# IFLOW_OAUTH_CLIENT_SECRET=
|
|
# ANTIGRAVITY_OAUTH_CLIENT_ID=
|
|
# ANTIGRAVITY_OAUTH_CLIENT_SECRET=
|
|
|
|
# API Key Providers (Phase 1 + Phase 4)
|
|
# Add via Dashboard → Providers → Add API Key, or set here
|
|
# DEEPSEEK_API_KEY=
|
|
# GROQ_API_KEY=
|
|
# XAI_API_KEY=
|
|
# MISTRAL_API_KEY=
|
|
# PERPLEXITY_API_KEY=
|
|
# TOGETHER_API_KEY=
|
|
# FIREWORKS_API_KEY=
|
|
# CEREBRAS_API_KEY=
|
|
# COHERE_API_KEY=
|
|
# NVIDIA_API_KEY=
|
|
|
|
# Embedding Providers (optional — used by /v1/embeddings)
|
|
# NEBIUS_API_KEY=
|
|
# Provider keys above (openai, mistral, together, fireworks, nvidia) also work for embeddings
|
|
|
|
# Timeout settings
|
|
# FETCH_TIMEOUT_MS=120000
|
|
# STREAM_IDLE_TIMEOUT_MS=60000
|
|
|
|
# CORS configuration (default: * allows all origins)
|
|
# CORS_ORIGINS=*
|
|
|
|
# Logging
|
|
# LOG_LEVEL=info
|
|
# LOG_FORMAT=text
|