Giorgio Gilestro
411094d7b8
New independent `admin` service (admin.main:app) on the same image, reusing app.db/app.models read-only. Never runs migrations or the scheduler; issues SELECTs only. - Password-gated (ADMIN_CONSOLE_PASSWORD) with a 12h signed cookie; closed by default when the password is empty. - Bound to 127.0.0.1:8091 (SSH-tunnel access); off the intranet/NPM network. - Pages: overview stats, user list + search, per-user history/payment detail, DB usage (information_schema size + row estimates). - Compose: base `admin` service (+prod DB-host override, test mount); Dockerfile bakes admin/ into runtime + test stages. - Tests: tests/test_admin_console.py (auth, queries, page wiring) — 12 passing. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
2.1 KiB
Text
42 lines
2.1 KiB
Text
# Cassandra environment — copy to .env and fill in.
|
|
# .env is mounted read-only into the containers; never commit real secrets.
|
|
|
|
# --- Database (MariaDB) ---
|
|
MARIADB_ROOT_PASSWORD=changeme-root
|
|
MARIADB_DATABASE=cassandra
|
|
MARIADB_USER=cassandra
|
|
MARIADB_PASSWORD=changeme
|
|
|
|
# --- API keys (mirror of the prototype .env) ---
|
|
API_KEY= # Trading 212 API key
|
|
SECRET_KEY= # Trading 212 secret
|
|
FRED_API_KEY= # FRED economic data
|
|
OPENROUTER_API_KEY= # OpenRouter (AI log generation)
|
|
|
|
# --- App ---
|
|
CASSANDRA_TOKEN= # Bearer token required if set; LAN-only no-auth if empty
|
|
CASSANDRA_PORT=8000
|
|
|
|
# --- Superadmin console (internal-only, separate `admin` container) ---
|
|
# Password for the read-only operator dashboard at 127.0.0.1:8091 (reach it
|
|
# via `ssh -L 8091:localhost:8091 <vps>`). Empty = console refuses every
|
|
# login (closed by default). Set a strong value in prod.
|
|
ADMIN_CONSOLE_PASSWORD=
|
|
ADMIN_CONSOLE_SESSION_SECRET= # cookie signing key; falls back to CASSANDRA_SESSION_SECRET/TOKEN if empty
|
|
CASSANDRA_BASE_CURRENCY=GBP
|
|
CASSANDRA_ANCHOR_DATE=2026-03-04 # YYYY-MM-DD; used by market_pulse anchor column
|
|
CASSANDRA_MOCK=0 # 1 = serve canned fixtures, skip live APIs
|
|
|
|
# --- AI log ---
|
|
OPENROUTER_MODEL=deepseek/deepseek-v4-flash # cheap & fast; swap to anthropic/claude-sonnet-4.6 or anthropic/claude-opus-4.7 for higher quality
|
|
OPENROUTER_MONTHLY_CAP_USD=20
|
|
CASSANDRA_TONE=INTERMEDIATE # NOVICE | INTERMEDIATE | PRO
|
|
CASSANDRA_ANALYSIS=SPECULATIVE # DRY | SPECULATIVE
|
|
|
|
# --- Compliance feature flags (default false = compliance-safe) ---
|
|
# See docs/read-markets-compliance-changes.md. Code paths stay in the tree;
|
|
# flip a flag to reactivate.
|
|
PORTFOLIO_AI_ENABLED=false # /api/analyze + dashboard AI read + reviewer portfolio rider
|
|
PORTFOLIO_SYNC_ENABLED=false # /api/portfolio/sync* + cloud-sync UI + PortfolioSync writes
|
|
TICKER_UNIVERSE_AGGREGATE_ENABLED=false # ticker_universe buffer/flush/upsert writes (server-learns-nothing)
|
|
SUBSCRIPTIONS_ENABLED=false # Stripe checkout/webhook/portal + /pricing + paid-tier gating
|