mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-08-13 12:40:35 +00:00
3347ebca7a
- run_import_workflow.py, run_multi_import.py: replace hardcoded budget password with BUDGET_PASSWORD env-var (fail-fast if unset) - server.js /ingest: replace shell-interpolated exec() with execFile() so user-controlled title/body cannot inject shell commands - authentik-values.yaml: blank out bootstrap_password and bootstrap_token so they must be supplied at deploy time via --set or sealed-secret - cluster-dashboard main.py: restrict CORS from allow_origins=["*"] to env-configurable whitelist (default: dashboard.researchstack.info), methods to GET, headers to Authorization+Content-Type - neo4j_obsidian_connector_router.js (both copies): replace permissive prefix-only readOnly regex with a deny-list that blocks CREATE/MERGE/DELETE/DETACH/SET/REMOVE/DROP anywhere in the query, and route readOnly queries through session.readTransaction() Co-Authored-By: Allaun Silverfox <bigdataiscoming+9i37y6j2@protonmail.com>
40 lines
749 B
YAML
40 lines
749 B
YAML
global:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: qfox-1
|
|
|
|
authentik:
|
|
log_level: info
|
|
secret_key: "" # Will be auto-generated
|
|
bootstrap_password: "" # REQUIRED: set via --set or sealed-secret before deploy
|
|
bootstrap_token: "" # REQUIRED: set via --set or sealed-secret before deploy
|
|
email:
|
|
host: ""
|
|
port: 587
|
|
username: ""
|
|
password: ""
|
|
|
|
postgresql:
|
|
enabled: true
|
|
persistence:
|
|
enabled: true
|
|
size: 10Gi
|
|
primary:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: qfox-1
|
|
|
|
redis:
|
|
enabled: true
|
|
master:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: qfox-1
|
|
|
|
server:
|
|
service:
|
|
type: NodePort
|
|
nodePort: 30095
|
|
ingress:
|
|
enabled: false
|
|
|
|
worker:
|
|
nodeSelector:
|
|
kubernetes.io/hostname: qfox-1
|