.env.example

SUB2API_CRM_LISTEN_ADDR=:8080
SUB2API_CRM_SQLITE_DSN=file:/data/sub2api-cn-relay-manager.db?_foreign_keys=on&_busy_timeout=5000
SUB2API_CRM_ADMIN_TOKEN=change-me-before-production
SUB2API_CRM_ADMIN_USERNAME=admin
SUB2API_CRM_ADMIN_PASSWORD=change-me-before-production
SUB2API_CRM_ADMIN_SESSION_TTL=12h
SUB2API_CRM_ROUTE_RUNTIME_BACKEND=memory
SUB2API_CRM_REDIS_ADDR=
SUB2API_CRM_REDIS_PASSWORD=
SUB2API_CRM_REDIS_DB=0

# Trusted Subject Proxy Configuration (for portal user key self-service)
# These must be synchronized with nginx config
SUB2API_CRM_TRUSTED_SUBJECT_HEADER=X-CRM-Authenticated-Subject
SUB2API_CRM_TRUSTED_PROXY_SECRET_HEADER=X-CRM-Trusted-Proxy
SUB2API_CRM_TRUSTED_PROXY_SECRET=change-me-64-char-hex-secret-for-production
test(project): achieve ≥70% package coverage across all internal packages - store/sqlite: 75.4% (repos + db coverage) - host/sub2api: 80.8% (httptest mock server, pure function tests) - app: 74.2% (handler error paths, NewActionSet closures) - pack: 72.4% - provision: 75.2% - access: 77.3% - config: 94.7% (lookup mock tests) All tests pass: build, vet, race, coverage gates. 2026-05-15 19:26:25 +08:00			`SUB2API_CRM_LISTEN_ADDR=:8080`
			`SUB2API_CRM_SQLITE_DSN=file:/data/sub2api-cn-relay-manager.db?_foreign_keys=on&_busy_timeout=5000`
			`SUB2API_CRM_ADMIN_TOKEN=change-me-before-production`
feat(admin): add session-based portal login 2026-05-28 11:01:29 +08:00			`SUB2API_CRM_ADMIN_USERNAME=admin`
			`SUB2API_CRM_ADMIN_PASSWORD=change-me-before-production`
			`SUB2API_CRM_ADMIN_SESSION_TTL=12h`
feat(routing): add sticky runtime backends 2026-05-29 07:43:29 +08:00			`SUB2API_CRM_ROUTE_RUNTIME_BACKEND=memory`
			`SUB2API_CRM_REDIS_ADDR=`
			`SUB2API_CRM_REDIS_PASSWORD=`
			`SUB2API_CRM_REDIS_DB=0`
feat(vNext.4): implement trusted-subject security chain for portal user key self-service - Add portal_auth.go: Portal user session auth with HMAC-signed cookies - Add /api/portal/session/{login,logout,state} endpoints - Update nginx config template: cookie-to-header trusted proxy pattern - Update frontend: sync CRM session on login/logout - Add TRUSTED_SUBJECT_DEPLOY_GUIDE.md with remote43 deployment steps - Update EXECUTION_BOARD.md: mark trusted-subject blocking issue as resolved This implements the secure chain: Browser → Portal → nginx (cookie→header) → CRM (verify proxy secret) Required remote43 actions: 1. Generate 64-char hex secret 2. Update .env.crm with TRUSTED_* config 3. Update nginx with cookie map and header injection 4. Restart services Fixes EXECUTION_BOARD.md 2026-06-08 blocking issue 2026-06-09 07:48:03 +08:00
			`# Trusted Subject Proxy Configuration (for portal user key self-service)`
			`# These must be synchronized with nginx config`
			`SUB2API_CRM_TRUSTED_SUBJECT_HEADER=X-CRM-Authenticated-Subject`
			`SUB2API_CRM_TRUSTED_PROXY_SECRET_HEADER=X-CRM-Trusted-Proxy`
			`SUB2API_CRM_TRUSTED_PROXY_SECRET=change-me-64-char-hex-secret-for-production`