Claude
7a21cc636c
Standalone bot/ service (its own package.json/Dockerfile) managed entirely through a new admin-only Discord Bot panel — token stored encrypted in the DB and pushed to the bot process in-memory, never an env var. Built in phases, each independently verified against a live Discord guild: - Bot skeleton: gateway connection, internal shared-secret API, self-heals on its own restart by pulling config from the site - Moderation core: /ban /kick /mute /warn /warnings + mod-log channel - Word/invite/spam filtering with leetspeak-resistant normalization and a staff role/channel allowlist - Scheduled messages: recurring (cron) and one-off channel posts - Role assignment: button role menus, auto-role on join, temp roles, bulk role ops - Auto-rotating primary invite with an audit log - Site integration: news-publish -> Discord announce webhook, manual /announce, read-only /wiki search Also fixes a pre-existing bug in both DB pools (server + bot): the mariadb driver defaulted to timezone 'local', silently mis-serializing bound Date params by the host's local offset instead of the DB's UTC session. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
71 lines
2.8 KiB
Plaintext
71 lines
2.8 KiB
Plaintext
# ─── UOMysticmoon — root environment (used by docker-compose) ───
|
|
# Copy to .env and fill in. NEVER commit the real .env.
|
|
|
|
# App
|
|
NODE_ENV=production
|
|
PORT=3000
|
|
UPLOAD_DIR=/app/uploads
|
|
# Logging — written to BOTH the console and a log file.
|
|
LOG_LEVEL=info # console verbosity: error | warn | info | debug
|
|
FILE_LOG_LEVEL=debug # file verbosity (keep a full record on disk)
|
|
LOG_TO_FILE=true # set false for console-only
|
|
LOG_DIR=/app/logs # log directory inside the container (bind-mounted to ./logs)
|
|
LOG_FILE=app.log
|
|
|
|
# Database (the values here are shared by the `db`, `app`, and `bot` containers —
|
|
# the bot only ever touches its own tables: guild_config, mod_actions, warnings)
|
|
DB_HOST=db
|
|
DB_PORT=3306
|
|
DB_NAME=uomysticmoon
|
|
DB_USER=uomm
|
|
DB_PASSWORD=change-me-db-password
|
|
DB_ROOT_PASSWORD=change-me-root-password
|
|
|
|
# Auth
|
|
JWT_SECRET=change-me-to-a-long-random-string
|
|
JWT_EXPIRES_IN=1d
|
|
# auto = Secure cookie only when the request arrives over HTTPS (Pangolin).
|
|
# Leave as auto so login works both via the LAN IP (HTTP) and the proxy (HTTPS).
|
|
COOKIE_SECURE=auto
|
|
COOKIE_NAME=uomm_token
|
|
|
|
# Reverse-proxy trust (req.ip / req.secure for rate limiting, backoff, bot-ban).
|
|
# Path: client -> Pangolin -> newt agent "ptero" (separate VM) -> app. Pin this
|
|
# to ptero's LAN IP (e.g. 10.0.0.42) so XFF is only trusted from ptero. Requires
|
|
# a static DHCP reservation for ptero in Omada, else a lease change breaks it.
|
|
# Integer hop count or "false" also accepted; a blanket "true" is rejected
|
|
# (coerced to 1) to prevent X-Forwarded-For spoofing.
|
|
TRUST_PROXY=1
|
|
# Set to 1 to log raw peer address + X-Forwarded-For + resolved req.ip per
|
|
# request (to verify/refresh ptero's IP without redeploying). Noisy; keep off.
|
|
DEBUG_TRUST_PROXY=0
|
|
|
|
# Optional TOTP two-factor (opt-in per user).
|
|
TOTP_ISSUER=UOMysticmoon
|
|
TOTP_CHALLENGE_TTL=5m
|
|
|
|
# First admin bootstrap — created only if no users exist yet.
|
|
# Set, run once, then you can blank these out.
|
|
ADMIN_USERNAME=
|
|
ADMIN_PASSWORD=
|
|
|
|
# Email (optional). If SMTP_HOST is blank, the contact endpoint tells the
|
|
# client to fall back to a mailto: link instead.
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
CONTACT_TO=UOMysticmoon@gmail.com
|
|
|
|
# CORS — only needed for local dev when the Vite dev server is a different origin.
|
|
CLIENT_ORIGIN=http://localhost:5173
|
|
|
|
# Discord bot — internal API (server <-> bot/, see docker-compose.yml's `bot`
|
|
# service). BOT_INTERNAL_KEY MUST be byte-for-byte identical to the same
|
|
# variable in bot/.env.example — it is the only auth on both sides' /internal/*
|
|
# routes, so a mismatch silently breaks every server<->bot call with 401s.
|
|
# The Discord bot TOKEN itself is not an env var — it's entered in the admin
|
|
# panel (Discord Bot page) and stored encrypted in the DB (see bot_config table).
|
|
BOT_INTERNAL_URL=http://bot:4100
|
|
BOT_INTERNAL_KEY=change-me-to-a-long-random-string
|