Tejas Chopra
1f96dabc19
Hardens client-selected upstreams, memory identity resolution, downloaded binary integrity, telemetry import, Docker defaults, Neo4j credentials, and archive extraction. Refreshes the branch against current main and preserves newer same-origin and loopback protections.
15 lines
602 B
Bash
15 lines
602 B
Bash
# Copy this file to .env and fill in real values before running.
|
|
# docker-compose.yml requires these — it will refuse to start with defaults.
|
|
|
|
# Neo4j credentials for the graph memory backend (format: user/password).
|
|
NEO4J_AUTH=neo4j/CHANGEME
|
|
# Password only, for library / non-Docker use of the Neo4j memory backend.
|
|
NEO4J_PASSWORD=CHANGEME
|
|
|
|
# Proxy token — gates the data plane whenever the proxy is not loopback-only.
|
|
# Generate: openssl rand -hex 32
|
|
HEADROOM_PROXY_TOKEN=CHANGEME
|
|
|
|
# Optional: set to 0.0.0.0 to expose the proxy on the network (requires a token).
|
|
# HEADROOM_BIND_ADDR=127.0.0.1
|