4e2ee087fd
- Add portal_auth.go: Portal user session auth with HMAC-signed cookies
- Add /api/portal/session/{login,logout,state} endpoints
- Update nginx config template: cookie-to-header trusted proxy pattern
- Update frontend: sync CRM session on login/logout
- Add TRUSTED_SUBJECT_DEPLOY_GUIDE.md with remote43 deployment steps
- Update EXECUTION_BOARD.md: mark trusted-subject blocking issue as resolved
This implements the secure chain:
Browser → Portal → nginx (cookie→header) → CRM (verify proxy secret)
Required remote43 actions:
1. Generate 64-char hex secret
2. Update .env.crm with TRUSTED_* config
3. Update nginx with cookie map and header injection
4. Restart services
Fixes EXECUTION_BOARD.md 2026-06-08 blocking issue
17 lines
739 B
Plaintext
17 lines
739 B
Plaintext
SUB2API_CRM_LISTEN_ADDR=:8080
|
|
SUB2API_CRM_SQLITE_DSN=file:/data/sub2api-cn-relay-manager.db?_foreign_keys=on&_busy_timeout=5000
|
|
SUB2API_CRM_ADMIN_TOKEN=change-me-before-production
|
|
SUB2API_CRM_ADMIN_USERNAME=admin
|
|
SUB2API_CRM_ADMIN_PASSWORD=change-me-before-production
|
|
SUB2API_CRM_ADMIN_SESSION_TTL=12h
|
|
SUB2API_CRM_ROUTE_RUNTIME_BACKEND=memory
|
|
SUB2API_CRM_REDIS_ADDR=
|
|
SUB2API_CRM_REDIS_PASSWORD=
|
|
SUB2API_CRM_REDIS_DB=0
|
|
|
|
# Trusted Subject Proxy Configuration (for portal user key self-service)
|
|
# These must be synchronized with nginx config
|
|
SUB2API_CRM_TRUSTED_SUBJECT_HEADER=X-CRM-Authenticated-Subject
|
|
SUB2API_CRM_TRUSTED_PROXY_SECRET_HEADER=X-CRM-Trusted-Proxy
|
|
SUB2API_CRM_TRUSTED_PROXY_SECRET=change-me-64-char-hex-secret-for-production
|