codegirl007/plumber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Address production-readiness review: clearer errors, safer votes, and ops hardening.

Browse Source 
Distinguish auth/lookup failures, make votes idempotent on visible questions, bound shutdown, page admin users, LRU throttle, trusted-proxy CIDRs, avatar cleanup, versioned migrations, and session cleanup logging.
This commit is contained in:
codegirl007
2026-08-22 12:16:59 -07:00
parent 5bdaa8977f
commit 29b0536215
26 changed files with 612 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+3 -2
View File
@@ -11,8 +11,9 @@ DATABASE_URL=postgresql://user:password@host.example.com:5432/postgres?sslmode=v
# When PORT is set (App Platform), cookies are Secure by default; SECURE_COOKIE=0 is rejected.
# Locally, set to 1 when serving over HTTPS:
SECURE_COOKIE=0
# Set to 1 only behind a trusted reverse proxy that sets X-Forwarded-For.
# TRUST_PROXY=0
# Comma-separated CIDRs of reverse proxies allowed to set X-Forwarded-For
# (direct peer must match). Leave unset to ignore XFF and use RemoteAddr.
# TRUSTED_PROXY_CIDRS=10.0.0.0/8,192.168.0.0/16
# DigitalOcean Spaces (profile avatars). Leave unset to disable uploads.
# SPACES_KEY=
# SPACES_SECRET=