diff options
Diffstat (limited to 'src/internal-server/config')
-rw-r--r-- | src/internal-server/config/app.js | 240 | ||||
-rw-r--r-- | src/internal-server/config/auth.js | 92 | ||||
-rw-r--r-- | src/internal-server/config/bodyParser.js | 155 | ||||
-rw-r--r-- | src/internal-server/config/cors.js | 85 | ||||
-rw-r--r-- | src/internal-server/config/database.js | 82 | ||||
-rw-r--r-- | src/internal-server/config/drive.js | 45 | ||||
-rw-r--r-- | src/internal-server/config/hash.js | 47 | ||||
-rw-r--r-- | src/internal-server/config/session.js | 97 | ||||
-rw-r--r-- | src/internal-server/config/shield.js | 143 |
9 files changed, 986 insertions, 0 deletions
diff --git a/src/internal-server/config/app.js b/src/internal-server/config/app.js new file mode 100644 index 000000000..0a1644932 --- /dev/null +++ b/src/internal-server/config/app.js | |||
@@ -0,0 +1,240 @@ | |||
1 | /** @type {import('@adonisjs/framework/src/Env')} */ | ||
2 | const Env = use('Env'); | ||
3 | |||
4 | module.exports = { | ||
5 | |||
6 | /* | ||
7 | |-------------------------------------------------------------------------- | ||
8 | | Application Name | ||
9 | |-------------------------------------------------------------------------- | ||
10 | | | ||
11 | | This value is the name of your application and can used when you | ||
12 | | need to place the application's name in a email, view or | ||
13 | | other location. | ||
14 | | | ||
15 | */ | ||
16 | |||
17 | name: Env.get('APP_NAME', 'Ferdi Internal Server'), | ||
18 | |||
19 | /* | ||
20 | |-------------------------------------------------------------------------- | ||
21 | | App Key | ||
22 | |-------------------------------------------------------------------------- | ||
23 | | | ||
24 | | App key is a randomly generated 16 or 32 characters long string required | ||
25 | | to encrypt cookies, sessions and other sensitive data. | ||
26 | | | ||
27 | */ | ||
28 | appKey: Env.getOrFail('APP_KEY'), | ||
29 | |||
30 | http: { | ||
31 | /* | ||
32 | |-------------------------------------------------------------------------- | ||
33 | | Allow Method Spoofing | ||
34 | |-------------------------------------------------------------------------- | ||
35 | | | ||
36 | | Method spoofing allows to make requests by spoofing the http verb. | ||
37 | | Which means you can make a GET request but instruct the server to | ||
38 | | treat as a POST or PUT request. If you want this feature, set the | ||
39 | | below value to true. | ||
40 | | | ||
41 | */ | ||
42 | allowMethodSpoofing: true, | ||
43 | |||
44 | /* | ||
45 | |-------------------------------------------------------------------------- | ||
46 | | Trust Proxy | ||
47 | |-------------------------------------------------------------------------- | ||
48 | | | ||
49 | | Trust proxy defines whether X-Forwarded-* headers should be trusted or not. | ||
50 | | When your application is behind a proxy server like nginx, these values | ||
51 | | are set automatically and should be trusted. Apart from setting it | ||
52 | | to true or false Adonis supports handful or ways to allow proxy | ||
53 | | values. Read documentation for that. | ||
54 | | | ||
55 | */ | ||
56 | trustProxy: false, | ||
57 | |||
58 | /* | ||
59 | |-------------------------------------------------------------------------- | ||
60 | | Subdomains | ||
61 | |-------------------------------------------------------------------------- | ||
62 | | | ||
63 | | Offset to be used for returning subdomains for a given request.For | ||
64 | | majority of applications it will be 2, until you have nested | ||
65 | | sudomains. | ||
66 | | cheatsheet.adonisjs.com - offset - 2 | ||
67 | | virk.cheatsheet.adonisjs.com - offset - 3 | ||
68 | | | ||
69 | */ | ||
70 | subdomainOffset: 2, | ||
71 | |||
72 | /* | ||
73 | |-------------------------------------------------------------------------- | ||
74 | | JSONP Callback | ||
75 | |-------------------------------------------------------------------------- | ||
76 | | | ||
77 | | Default jsonp callback to be used when callback query string is missing | ||
78 | | in request url. | ||
79 | | | ||
80 | */ | ||
81 | jsonpCallback: 'callback', | ||
82 | |||
83 | /* | ||
84 | |-------------------------------------------------------------------------- | ||
85 | | Etag | ||
86 | |-------------------------------------------------------------------------- | ||
87 | | | ||
88 | | Set etag on all HTTP response. In order to disable for selected routes, | ||
89 | | you can call the `response.send` with an options object as follows. | ||
90 | | | ||
91 | | response.send('Hello', { ignoreEtag: true }) | ||
92 | | | ||
93 | */ | ||
94 | etag: false, | ||
95 | }, | ||
96 | |||
97 | views: { | ||
98 | /* | ||
99 | |-------------------------------------------------------------------------- | ||
100 | | Cache Views | ||
101 | |-------------------------------------------------------------------------- | ||
102 | | | ||
103 | | Define whether or not to cache the compiled view. Set it to true in | ||
104 | | production to optimize view loading time. | ||
105 | | | ||
106 | */ | ||
107 | cache: Env.get('CACHE_VIEWS', true), | ||
108 | }, | ||
109 | |||
110 | static: { | ||
111 | /* | ||
112 | |-------------------------------------------------------------------------- | ||
113 | | Dot Files | ||
114 | |-------------------------------------------------------------------------- | ||
115 | | | ||
116 | | Define how to treat dot files when trying to server static resources. | ||
117 | | By default it is set to ignore, which will pretend that dotfiles | ||
118 | | does not exists. | ||
119 | | | ||
120 | | Can be one of the following | ||
121 | | ignore, deny, allow | ||
122 | | | ||
123 | */ | ||
124 | dotfiles: 'ignore', | ||
125 | |||
126 | /* | ||
127 | |-------------------------------------------------------------------------- | ||
128 | | ETag | ||
129 | |-------------------------------------------------------------------------- | ||
130 | | | ||
131 | | Enable or disable etag generation | ||
132 | | | ||
133 | */ | ||
134 | etag: true, | ||
135 | |||
136 | /* | ||
137 | |-------------------------------------------------------------------------- | ||
138 | | Extensions | ||
139 | |-------------------------------------------------------------------------- | ||
140 | | | ||
141 | | Set file extension fallbacks. When set, if a file is not found, the given | ||
142 | | extensions will be added to the file name and search for. The first | ||
143 | | that exists will be served. Example: ['html', 'htm']. | ||
144 | | | ||
145 | */ | ||
146 | extensions: false, | ||
147 | }, | ||
148 | |||
149 | locales: { | ||
150 | /* | ||
151 | |-------------------------------------------------------------------------- | ||
152 | | Loader | ||
153 | |-------------------------------------------------------------------------- | ||
154 | | | ||
155 | | The loader to be used for fetching and updating locales. Below is the | ||
156 | | list of available options. | ||
157 | | | ||
158 | | file, database | ||
159 | | | ||
160 | */ | ||
161 | loader: 'file', | ||
162 | |||
163 | /* | ||
164 | |-------------------------------------------------------------------------- | ||
165 | | Default Locale | ||
166 | |-------------------------------------------------------------------------- | ||
167 | | | ||
168 | | Default locale to be used by Antl provider. You can always switch drivers | ||
169 | | in runtime or use the official Antl middleware to detect the driver | ||
170 | | based on HTTP headers/query string. | ||
171 | | | ||
172 | */ | ||
173 | locale: 'en', | ||
174 | }, | ||
175 | |||
176 | logger: { | ||
177 | /* | ||
178 | |-------------------------------------------------------------------------- | ||
179 | | Transport | ||
180 | |-------------------------------------------------------------------------- | ||
181 | | | ||
182 | | Transport to be used for logging messages. You can have multiple | ||
183 | | transports using same driver. | ||
184 | | | ||
185 | | Available drivers are: `file` and `console`. | ||
186 | | | ||
187 | */ | ||
188 | transport: 'console', | ||
189 | |||
190 | /* | ||
191 | |-------------------------------------------------------------------------- | ||
192 | | Console Transport | ||
193 | |-------------------------------------------------------------------------- | ||
194 | | | ||
195 | | Using `console` driver for logging. This driver writes to `stdout` | ||
196 | | and `stderr` | ||
197 | | | ||
198 | */ | ||
199 | console: { | ||
200 | driver: 'console', | ||
201 | name: 'adonis-app', | ||
202 | level: 'info', | ||
203 | }, | ||
204 | |||
205 | /* | ||
206 | |-------------------------------------------------------------------------- | ||
207 | | File Transport | ||
208 | |-------------------------------------------------------------------------- | ||
209 | | | ||
210 | | File transport uses file driver and writes log messages for a given | ||
211 | | file inside `tmp` directory for your app. | ||
212 | | | ||
213 | | For a different directory, set an absolute path for the filename. | ||
214 | | | ||
215 | */ | ||
216 | file: { | ||
217 | driver: 'file', | ||
218 | name: 'adonis-app', | ||
219 | filename: 'adonis.log', | ||
220 | level: 'info', | ||
221 | }, | ||
222 | }, | ||
223 | |||
224 | /* | ||
225 | |-------------------------------------------------------------------------- | ||
226 | | Generic Cookie Options | ||
227 | |-------------------------------------------------------------------------- | ||
228 | | | ||
229 | | The following cookie options are generic settings used by AdonisJs to create | ||
230 | | cookies. However, some parts of the application like `sessions` can have | ||
231 | | separate settings for cookies inside `config/session.js`. | ||
232 | | | ||
233 | */ | ||
234 | cookie: { | ||
235 | httpOnly: true, | ||
236 | sameSite: false, | ||
237 | path: '/', | ||
238 | maxAge: 7200, | ||
239 | }, | ||
240 | }; | ||
diff --git a/src/internal-server/config/auth.js b/src/internal-server/config/auth.js new file mode 100644 index 000000000..adb38126a --- /dev/null +++ b/src/internal-server/config/auth.js | |||
@@ -0,0 +1,92 @@ | |||
1 | /** @type {import('@adonisjs/framework/src/Env')} */ | ||
2 | const Env = use('Env'); | ||
3 | |||
4 | module.exports = { | ||
5 | /* | ||
6 | |-------------------------------------------------------------------------- | ||
7 | | Authenticator | ||
8 | |-------------------------------------------------------------------------- | ||
9 | | | ||
10 | | Authentication is a combination of serializer and scheme with extra | ||
11 | | config to define on how to authenticate a user. | ||
12 | | | ||
13 | | Available Schemes - basic, session, jwt, api | ||
14 | | Available Serializers - lucid, database | ||
15 | | | ||
16 | */ | ||
17 | authenticator: 'jwt', | ||
18 | |||
19 | /* | ||
20 | |-------------------------------------------------------------------------- | ||
21 | | Session | ||
22 | |-------------------------------------------------------------------------- | ||
23 | | | ||
24 | | Session authenticator makes use of sessions to authenticate a user. | ||
25 | | Session authentication is always persistent. | ||
26 | | | ||
27 | */ | ||
28 | session: { | ||
29 | serializer: 'lucid', | ||
30 | model: 'App/Models/User', | ||
31 | scheme: 'session', | ||
32 | uid: 'email', | ||
33 | password: 'password', | ||
34 | }, | ||
35 | |||
36 | /* | ||
37 | |-------------------------------------------------------------------------- | ||
38 | | Basic Auth | ||
39 | |-------------------------------------------------------------------------- | ||
40 | | | ||
41 | | The basic auth authenticator uses basic auth header to authenticate a | ||
42 | | user. | ||
43 | | | ||
44 | | NOTE: | ||
45 | | This scheme is not persistent and users are supposed to pass | ||
46 | | login credentials on each request. | ||
47 | | | ||
48 | */ | ||
49 | basic: { | ||
50 | serializer: 'lucid', | ||
51 | model: 'App/Models/User', | ||
52 | scheme: 'basic', | ||
53 | uid: 'email', | ||
54 | password: 'password', | ||
55 | }, | ||
56 | |||
57 | /* | ||
58 | |-------------------------------------------------------------------------- | ||
59 | | Jwt | ||
60 | |-------------------------------------------------------------------------- | ||
61 | | | ||
62 | | The jwt authenticator works by passing a jwt token on each HTTP request | ||
63 | | via HTTP `Authorization` header. | ||
64 | | | ||
65 | */ | ||
66 | jwt: { | ||
67 | serializer: 'lucid', | ||
68 | model: 'App/Models/User', | ||
69 | scheme: 'jwt', | ||
70 | uid: 'email', | ||
71 | password: 'password', | ||
72 | options: { | ||
73 | secret: Env.get('APP_KEY'), | ||
74 | }, | ||
75 | }, | ||
76 | |||
77 | /* | ||
78 | |-------------------------------------------------------------------------- | ||
79 | | Api | ||
80 | |-------------------------------------------------------------------------- | ||
81 | | | ||
82 | | The Api scheme makes use of API personal tokens to authenticate a user. | ||
83 | | | ||
84 | */ | ||
85 | api: { | ||
86 | serializer: 'lucid', | ||
87 | model: 'App/Models/User', | ||
88 | scheme: 'api', | ||
89 | uid: 'email', | ||
90 | password: 'password', | ||
91 | }, | ||
92 | }; | ||
diff --git a/src/internal-server/config/bodyParser.js b/src/internal-server/config/bodyParser.js new file mode 100644 index 000000000..8a5406f9e --- /dev/null +++ b/src/internal-server/config/bodyParser.js | |||
@@ -0,0 +1,155 @@ | |||
1 | module.exports = { | ||
2 | /* | ||
3 | |-------------------------------------------------------------------------- | ||
4 | | JSON Parser | ||
5 | |-------------------------------------------------------------------------- | ||
6 | | | ||
7 | | Below settings are applied when the request body contains a JSON payload. | ||
8 | | If you want body parser to ignore JSON payloads, then simply set `types` | ||
9 | | to an empty array. | ||
10 | */ | ||
11 | json: { | ||
12 | /* | ||
13 | |-------------------------------------------------------------------------- | ||
14 | | limit | ||
15 | |-------------------------------------------------------------------------- | ||
16 | | | ||
17 | | Defines the limit of JSON that can be sent by the client. If payload | ||
18 | | is over 1mb it will not be processed. | ||
19 | | | ||
20 | */ | ||
21 | limit: '50mb', | ||
22 | |||
23 | /* | ||
24 | |-------------------------------------------------------------------------- | ||
25 | | strict | ||
26 | |-------------------------------------------------------------------------- | ||
27 | | | ||
28 | | When `strict` is set to true, body parser will only parse Arrays and | ||
29 | | Object. Otherwise everything parseable by `JSON.parse` is parsed. | ||
30 | | | ||
31 | */ | ||
32 | strict: true, | ||
33 | |||
34 | /* | ||
35 | |-------------------------------------------------------------------------- | ||
36 | | types | ||
37 | |-------------------------------------------------------------------------- | ||
38 | | | ||
39 | | Which content types are processed as JSON payloads. You are free to | ||
40 | | add your own types here, but the request body should be parseable | ||
41 | | by `JSON.parse` method. | ||
42 | | | ||
43 | */ | ||
44 | types: [ | ||
45 | 'application/json', | ||
46 | 'application/json-patch+json', | ||
47 | 'application/vnd.api+json', | ||
48 | 'application/csp-report', | ||
49 | ], | ||
50 | }, | ||
51 | |||
52 | /* | ||
53 | |-------------------------------------------------------------------------- | ||
54 | | Raw Parser | ||
55 | |-------------------------------------------------------------------------- | ||
56 | | | ||
57 | | | ||
58 | | | ||
59 | */ | ||
60 | raw: { | ||
61 | types: [ | ||
62 | 'text/*', | ||
63 | ], | ||
64 | }, | ||
65 | |||
66 | /* | ||
67 | |-------------------------------------------------------------------------- | ||
68 | | Form Parser | ||
69 | |-------------------------------------------------------------------------- | ||
70 | | | ||
71 | | | ||
72 | | | ||
73 | */ | ||
74 | form: { | ||
75 | types: [ | ||
76 | 'application/x-www-form-urlencoded', | ||
77 | ], | ||
78 | }, | ||
79 | |||
80 | /* | ||
81 | |-------------------------------------------------------------------------- | ||
82 | | Files Parser | ||
83 | |-------------------------------------------------------------------------- | ||
84 | | | ||
85 | | | ||
86 | | | ||
87 | */ | ||
88 | files: { | ||
89 | types: [ | ||
90 | 'multipart/form-data', | ||
91 | ], | ||
92 | |||
93 | /* | ||
94 | |-------------------------------------------------------------------------- | ||
95 | | Max Size | ||
96 | |-------------------------------------------------------------------------- | ||
97 | | | ||
98 | | Below value is the max size of all the files uploaded to the server. It | ||
99 | | is validated even before files have been processed and hard exception | ||
100 | | is thrown. | ||
101 | | | ||
102 | | Consider setting a reasonable value here, otherwise people may upload GB's | ||
103 | | of files which will keep your server busy. | ||
104 | | | ||
105 | | Also this value is considered when `autoProcess` is set to true. | ||
106 | | | ||
107 | */ | ||
108 | maxSize: '20mb', | ||
109 | |||
110 | /* | ||
111 | |-------------------------------------------------------------------------- | ||
112 | | Auto Process | ||
113 | |-------------------------------------------------------------------------- | ||
114 | | | ||
115 | | Whether or not to auto-process files. Since HTTP servers handle files via | ||
116 | | couple of specific endpoints. It is better to set this value off and | ||
117 | | manually process the files when required. | ||
118 | | | ||
119 | | This value can contain a boolean or an array of route patterns | ||
120 | | to be autoprocessed. | ||
121 | */ | ||
122 | autoProcess: true, | ||
123 | |||
124 | /* | ||
125 | |-------------------------------------------------------------------------- | ||
126 | | Process Manually | ||
127 | |-------------------------------------------------------------------------- | ||
128 | | | ||
129 | | The list of routes that should not process files and instead rely on | ||
130 | | manual process. This list should only contain routes when autoProcess | ||
131 | | is to true. Otherwise everything is processed manually. | ||
132 | | | ||
133 | */ | ||
134 | processManually: [], | ||
135 | |||
136 | /* | ||
137 | |-------------------------------------------------------------------------- | ||
138 | | Temporary file name | ||
139 | |-------------------------------------------------------------------------- | ||
140 | | | ||
141 | | Define a function, which should return a string to be used as the | ||
142 | | tmp file name. | ||
143 | | | ||
144 | | If not defined, Bodyparser will use `uuid` as the tmp file name. | ||
145 | | | ||
146 | | To be defined as. If you are defining the function, then do make sure | ||
147 | | to return a value from it. | ||
148 | | | ||
149 | | tmpFileName () { | ||
150 | | return 'some-unique-value' | ||
151 | | } | ||
152 | | | ||
153 | */ | ||
154 | }, | ||
155 | }; | ||
diff --git a/src/internal-server/config/cors.js b/src/internal-server/config/cors.js new file mode 100644 index 000000000..ca57dff0d --- /dev/null +++ b/src/internal-server/config/cors.js | |||
@@ -0,0 +1,85 @@ | |||
1 | module.exports = { | ||
2 | /* | ||
3 | |-------------------------------------------------------------------------- | ||
4 | | Origin | ||
5 | |-------------------------------------------------------------------------- | ||
6 | | | ||
7 | | Set a list of origins to be allowed. The value can be one of the following | ||
8 | | | ||
9 | | Boolean: true - Allow current request origin | ||
10 | | Boolean: false - Disallow all | ||
11 | | String - Comma separated list of allowed origins | ||
12 | | Array - An array of allowed origins | ||
13 | | String: * - A wildcard to allow current request origin | ||
14 | | Function - Receives the current origin and should return one of the above values. | ||
15 | | | ||
16 | */ | ||
17 | origin: false, | ||
18 | |||
19 | /* | ||
20 | |-------------------------------------------------------------------------- | ||
21 | | Methods | ||
22 | |-------------------------------------------------------------------------- | ||
23 | | | ||
24 | | HTTP methods to be allowed. The value can be one of the following | ||
25 | | | ||
26 | | String - Comma separated list of allowed methods | ||
27 | | Array - An array of allowed methods | ||
28 | | | ||
29 | */ | ||
30 | methods: ['GET', 'PUT', 'PATCH', 'POST', 'DELETE'], | ||
31 | |||
32 | /* | ||
33 | |-------------------------------------------------------------------------- | ||
34 | | Headers | ||
35 | |-------------------------------------------------------------------------- | ||
36 | | | ||
37 | | List of headers to be allowed via Access-Control-Request-Headers header. | ||
38 | | The value can be one of the following. | ||
39 | | | ||
40 | | Boolean: true - Allow current request headers | ||
41 | | Boolean: false - Disallow all | ||
42 | | String - Comma separated list of allowed headers | ||
43 | | Array - An array of allowed headers | ||
44 | | String: * - A wildcard to allow current request headers | ||
45 | | Function - Receives the current header and should return one of the above values. | ||
46 | | | ||
47 | */ | ||
48 | headers: true, | ||
49 | |||
50 | /* | ||
51 | |-------------------------------------------------------------------------- | ||
52 | | Expose Headers | ||
53 | |-------------------------------------------------------------------------- | ||
54 | | | ||
55 | | A list of headers to be exposed via `Access-Control-Expose-Headers` | ||
56 | | header. The value can be one of the following. | ||
57 | | | ||
58 | | Boolean: false - Disallow all | ||
59 | | String: Comma separated list of allowed headers | ||
60 | | Array - An array of allowed headers | ||
61 | | | ||
62 | */ | ||
63 | exposeHeaders: false, | ||
64 | |||
65 | /* | ||
66 | |-------------------------------------------------------------------------- | ||
67 | | Credentials | ||
68 | |-------------------------------------------------------------------------- | ||
69 | | | ||
70 | | Define Access-Control-Allow-Credentials header. It should always be a | ||
71 | | boolean. | ||
72 | | | ||
73 | */ | ||
74 | credentials: false, | ||
75 | |||
76 | /* | ||
77 | |-------------------------------------------------------------------------- | ||
78 | | MaxAge | ||
79 | |-------------------------------------------------------------------------- | ||
80 | | | ||
81 | | Define Access-Control-Allow-Max-Age | ||
82 | | | ||
83 | */ | ||
84 | maxAge: 90, | ||
85 | }; | ||
diff --git a/src/internal-server/config/database.js b/src/internal-server/config/database.js new file mode 100644 index 000000000..1b5974359 --- /dev/null +++ b/src/internal-server/config/database.js | |||
@@ -0,0 +1,82 @@ | |||
1 | /** @type {import('@adonisjs/framework/src/Env')} */ | ||
2 | const Env = use('Env'); | ||
3 | |||
4 | const dbPath = process.env.DB_PATH; | ||
5 | |||
6 | module.exports = { | ||
7 | /* | ||
8 | |-------------------------------------------------------------------------- | ||
9 | | Default Connection | ||
10 | |-------------------------------------------------------------------------- | ||
11 | | | ||
12 | | Connection defines the default connection settings to be used while | ||
13 | | interacting with SQL databases. | ||
14 | | | ||
15 | */ | ||
16 | connection: Env.get('DB_CONNECTION', 'sqlite'), | ||
17 | |||
18 | /* | ||
19 | |-------------------------------------------------------------------------- | ||
20 | | Sqlite | ||
21 | |-------------------------------------------------------------------------- | ||
22 | | | ||
23 | | Sqlite is a flat file database and can be a good choice for a development | ||
24 | | environment. | ||
25 | | | ||
26 | | npm i --save sqlite3 | ||
27 | | | ||
28 | */ | ||
29 | sqlite: { | ||
30 | client: 'sqlite3', | ||
31 | connection: { | ||
32 | // filename: Helpers.databasePath(`${Env.get('DB_DATABASE', 'development')}.sqlite`), | ||
33 | filename: dbPath, | ||
34 | }, | ||
35 | useNullAsDefault: true, | ||
36 | debug: Env.get('DB_DEBUG', false), | ||
37 | }, | ||
38 | |||
39 | /* | ||
40 | |-------------------------------------------------------------------------- | ||
41 | | MySQL | ||
42 | |-------------------------------------------------------------------------- | ||
43 | | | ||
44 | | Here we define connection settings for MySQL database. | ||
45 | | | ||
46 | | npm i --save mysql | ||
47 | | | ||
48 | */ | ||
49 | mysql: { | ||
50 | client: 'mysql', | ||
51 | connection: { | ||
52 | host: Env.get('DB_HOST', 'localhost'), | ||
53 | port: Env.get('DB_PORT', ''), | ||
54 | user: Env.get('DB_USER', 'root'), | ||
55 | password: Env.get('DB_PASSWORD', ''), | ||
56 | database: Env.get('DB_DATABASE', 'adonis'), | ||
57 | }, | ||
58 | debug: Env.get('DB_DEBUG', false), | ||
59 | }, | ||
60 | |||
61 | /* | ||
62 | |-------------------------------------------------------------------------- | ||
63 | | PostgreSQL | ||
64 | |-------------------------------------------------------------------------- | ||
65 | | | ||
66 | | Here we define connection settings for PostgreSQL database. | ||
67 | | | ||
68 | | npm i --save pg | ||
69 | | | ||
70 | */ | ||
71 | pg: { | ||
72 | client: 'pg', | ||
73 | connection: { | ||
74 | host: Env.get('DB_HOST', 'localhost'), | ||
75 | port: Env.get('DB_PORT', ''), | ||
76 | user: Env.get('DB_USER', 'root'), | ||
77 | password: Env.get('DB_PASSWORD', ''), | ||
78 | database: Env.get('DB_DATABASE', 'adonis'), | ||
79 | }, | ||
80 | debug: Env.get('DB_DEBUG', false), | ||
81 | }, | ||
82 | }; | ||
diff --git a/src/internal-server/config/drive.js b/src/internal-server/config/drive.js new file mode 100644 index 000000000..617ce470a --- /dev/null +++ b/src/internal-server/config/drive.js | |||
@@ -0,0 +1,45 @@ | |||
1 | const Env = use('Env'); | ||
2 | |||
3 | module.exports = { | ||
4 | /* | ||
5 | |-------------------------------------------------------------------------- | ||
6 | | Default disk | ||
7 | |-------------------------------------------------------------------------- | ||
8 | | | ||
9 | | The default disk is used when you interact with the file system without | ||
10 | | defining a disk name | ||
11 | | | ||
12 | */ | ||
13 | default: 'local', | ||
14 | |||
15 | disks: { | ||
16 | /* | ||
17 | |-------------------------------------------------------------------------- | ||
18 | | Local | ||
19 | |-------------------------------------------------------------------------- | ||
20 | | | ||
21 | | Local disk interacts with the a local folder inside your application | ||
22 | | | ||
23 | */ | ||
24 | local: { | ||
25 | root: `${__dirname}/../recipes`, | ||
26 | driver: 'local', | ||
27 | }, | ||
28 | |||
29 | /* | ||
30 | |-------------------------------------------------------------------------- | ||
31 | | S3 | ||
32 | |-------------------------------------------------------------------------- | ||
33 | | | ||
34 | | S3 disk interacts with a bucket on aws s3 | ||
35 | | | ||
36 | */ | ||
37 | s3: { | ||
38 | driver: 's3', | ||
39 | key: Env.get('S3_KEY'), | ||
40 | secret: Env.get('S3_SECRET'), | ||
41 | bucket: Env.get('S3_BUCKET'), | ||
42 | region: Env.get('S3_REGION'), | ||
43 | }, | ||
44 | }, | ||
45 | }; | ||
diff --git a/src/internal-server/config/hash.js b/src/internal-server/config/hash.js new file mode 100644 index 000000000..bbf32f691 --- /dev/null +++ b/src/internal-server/config/hash.js | |||
@@ -0,0 +1,47 @@ | |||
1 | /** @type {import('@adonisjs/framework/src/Env')} */ | ||
2 | const Env = use('Env'); | ||
3 | |||
4 | module.exports = { | ||
5 | /* | ||
6 | |-------------------------------------------------------------------------- | ||
7 | | Driver | ||
8 | |-------------------------------------------------------------------------- | ||
9 | | | ||
10 | | Driver to be used for hashing values. The same driver is used by the | ||
11 | | auth module too. | ||
12 | | | ||
13 | */ | ||
14 | driver: Env.get('HASH_DRIVER', 'bcrypt'), | ||
15 | |||
16 | /* | ||
17 | |-------------------------------------------------------------------------- | ||
18 | | Bcrypt | ||
19 | |-------------------------------------------------------------------------- | ||
20 | | | ||
21 | | Config related to bcrypt hashing. https://www.npmjs.com/package/bcrypt | ||
22 | | package is used internally. | ||
23 | | | ||
24 | */ | ||
25 | bcrypt: { | ||
26 | rounds: 10, | ||
27 | }, | ||
28 | |||
29 | /* | ||
30 | |-------------------------------------------------------------------------- | ||
31 | | Argon | ||
32 | |-------------------------------------------------------------------------- | ||
33 | | | ||
34 | | Config related to argon. https://www.npmjs.com/package/argon2 package is | ||
35 | | used internally. | ||
36 | | | ||
37 | | Since argon is optional, you will have to install the dependency yourself | ||
38 | | | ||
39 | |============================================================================ | ||
40 | | npm i argon2 | ||
41 | |============================================================================ | ||
42 | | | ||
43 | */ | ||
44 | argon: { | ||
45 | type: 1, | ||
46 | }, | ||
47 | }; | ||
diff --git a/src/internal-server/config/session.js b/src/internal-server/config/session.js new file mode 100644 index 000000000..3ce3cc4da --- /dev/null +++ b/src/internal-server/config/session.js | |||
@@ -0,0 +1,97 @@ | |||
1 | const Env = use('Env'); | ||
2 | |||
3 | module.exports = { | ||
4 | /* | ||
5 | |-------------------------------------------------------------------------- | ||
6 | | Session Driver | ||
7 | |-------------------------------------------------------------------------- | ||
8 | | | ||
9 | | The session driver to be used for storing session values. It can be | ||
10 | | cookie, file or redis. | ||
11 | | | ||
12 | | For `redis` driver, make sure to install and register `@adonisjs/redis` | ||
13 | | | ||
14 | */ | ||
15 | driver: Env.get('SESSION_DRIVER', 'cookie'), | ||
16 | |||
17 | /* | ||
18 | |-------------------------------------------------------------------------- | ||
19 | | Cookie Name | ||
20 | |-------------------------------------------------------------------------- | ||
21 | | | ||
22 | | The name of the cookie to be used for saving session id. Session ids | ||
23 | | are signed and encrypted. | ||
24 | | | ||
25 | */ | ||
26 | cookieName: 'adonis-session', | ||
27 | |||
28 | /* | ||
29 | |-------------------------------------------------------------------------- | ||
30 | | Clear session when browser closes | ||
31 | |-------------------------------------------------------------------------- | ||
32 | | | ||
33 | | If this value is true, the session cookie will be temporary and will be | ||
34 | | removed when browser closes. | ||
35 | | | ||
36 | */ | ||
37 | clearWithBrowser: true, | ||
38 | |||
39 | /* | ||
40 | |-------------------------------------------------------------------------- | ||
41 | | Session age | ||
42 | |-------------------------------------------------------------------------- | ||
43 | | | ||
44 | | This value is only used when `clearWithBrowser` is set to false. The | ||
45 | | age must be a valid https://npmjs.org/package/ms string or should | ||
46 | | be in milliseconds. | ||
47 | | | ||
48 | | Valid values are: | ||
49 | | '2h', '10d', '5y', '2.5 hrs' | ||
50 | | | ||
51 | */ | ||
52 | age: '2h', | ||
53 | |||
54 | /* | ||
55 | |-------------------------------------------------------------------------- | ||
56 | | Cookie options | ||
57 | |-------------------------------------------------------------------------- | ||
58 | | | ||
59 | | Cookie options defines the options to be used for setting up session | ||
60 | | cookie | ||
61 | | | ||
62 | */ | ||
63 | cookie: { | ||
64 | httpOnly: true, | ||
65 | path: '/', | ||
66 | sameSite: false, | ||
67 | }, | ||
68 | |||
69 | /* | ||
70 | |-------------------------------------------------------------------------- | ||
71 | | Sessions location | ||
72 | |-------------------------------------------------------------------------- | ||
73 | | | ||
74 | | If driver is set to file, we need to define the relative location from | ||
75 | | the temporary path or absolute url to any location. | ||
76 | | | ||
77 | */ | ||
78 | file: { | ||
79 | location: 'sessions', | ||
80 | }, | ||
81 | |||
82 | /* | ||
83 | |-------------------------------------------------------------------------- | ||
84 | | Redis config | ||
85 | |-------------------------------------------------------------------------- | ||
86 | | | ||
87 | | The configuration for the redis driver. | ||
88 | | | ||
89 | */ | ||
90 | redis: { | ||
91 | host: 'localhost', | ||
92 | port: 6379, | ||
93 | password: null, | ||
94 | db: 0, | ||
95 | keyPrefix: '', | ||
96 | }, | ||
97 | }; | ||
diff --git a/src/internal-server/config/shield.js b/src/internal-server/config/shield.js new file mode 100644 index 000000000..76f430e91 --- /dev/null +++ b/src/internal-server/config/shield.js | |||
@@ -0,0 +1,143 @@ | |||
1 | module.exports = { | ||
2 | /* | ||
3 | |-------------------------------------------------------------------------- | ||
4 | | Content Security Policy | ||
5 | |-------------------------------------------------------------------------- | ||
6 | | | ||
7 | | Content security policy filters out the origins not allowed to execute | ||
8 | | and load resources like scripts, styles and fonts. There are wide | ||
9 | | variety of options to choose from. | ||
10 | */ | ||
11 | csp: { | ||
12 | /* | ||
13 | |-------------------------------------------------------------------------- | ||
14 | | Directives | ||
15 | |-------------------------------------------------------------------------- | ||
16 | | | ||
17 | | All directives are defined in camelCase and here is the list of | ||
18 | | available directives and their possible values. | ||
19 | | | ||
20 | | https://content-security-policy.com | ||
21 | | | ||
22 | | @example | ||
23 | | directives: { | ||
24 | | defaultSrc: ['self', '@nonce', 'cdnjs.cloudflare.com'] | ||
25 | | } | ||
26 | | | ||
27 | */ | ||
28 | directives: { | ||
29 | }, | ||
30 | /* | ||
31 | |-------------------------------------------------------------------------- | ||
32 | | Report only | ||
33 | |-------------------------------------------------------------------------- | ||
34 | | | ||
35 | | Setting `reportOnly=true` will not block the scripts from running and | ||
36 | | instead report them to a URL. | ||
37 | | | ||
38 | */ | ||
39 | reportOnly: false, | ||
40 | /* | ||
41 | |-------------------------------------------------------------------------- | ||
42 | | Set all headers | ||
43 | |-------------------------------------------------------------------------- | ||
44 | | | ||
45 | | Headers staring with `X` have been depreciated, since all major browsers | ||
46 | | supports the standard CSP header. So its better to disable deperciated | ||
47 | | headers, unless you want them to be set. | ||
48 | | | ||
49 | */ | ||
50 | setAllHeaders: false, | ||
51 | |||
52 | /* | ||
53 | |-------------------------------------------------------------------------- | ||
54 | | Disable on android | ||
55 | |-------------------------------------------------------------------------- | ||
56 | | | ||
57 | | Certain versions of android are buggy with CSP policy. So you can set | ||
58 | | this value to true, to disable it for Android versions with buggy | ||
59 | | behavior. | ||
60 | | | ||
61 | | Here is an issue reported on a different package, but helpful to read | ||
62 | | if you want to know the behavior. https://github.com/helmetjs/helmet/pull/82 | ||
63 | | | ||
64 | */ | ||
65 | disableAndroid: true, | ||
66 | }, | ||
67 | |||
68 | /* | ||
69 | |-------------------------------------------------------------------------- | ||
70 | | X-XSS-Protection | ||
71 | |-------------------------------------------------------------------------- | ||
72 | | | ||
73 | | X-XSS Protection saves from applications from XSS attacks. It is adopted | ||
74 | | by IE and later followed by some other browsers. | ||
75 | | | ||
76 | | Learn more at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection | ||
77 | | | ||
78 | */ | ||
79 | xss: { | ||
80 | enabled: true, | ||
81 | enableOnOldIE: false, | ||
82 | }, | ||
83 | |||
84 | /* | ||
85 | |-------------------------------------------------------------------------- | ||
86 | | Iframe Options | ||
87 | |-------------------------------------------------------------------------- | ||
88 | | | ||
89 | | xframe defines whether or not your website can be embedded inside an | ||
90 | | iframe. Choose from one of the following options. | ||
91 | | @available options | ||
92 | | DENY, SAMEORIGIN, ALLOW-FROM http://example.com | ||
93 | | | ||
94 | | Learn more at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options | ||
95 | */ | ||
96 | xframe: 'DENY', | ||
97 | |||
98 | /* | ||
99 | |-------------------------------------------------------------------------- | ||
100 | | No Sniff | ||
101 | |-------------------------------------------------------------------------- | ||
102 | | | ||
103 | | Browsers have a habit of sniffing content-type of a response. Which means | ||
104 | | files with .txt extension containing Javascript code will be executed as | ||
105 | | Javascript. You can disable this behavior by setting nosniff to false. | ||
106 | | | ||
107 | | Learn more at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options | ||
108 | | | ||
109 | */ | ||
110 | nosniff: true, | ||
111 | |||
112 | /* | ||
113 | |-------------------------------------------------------------------------- | ||
114 | | No Open | ||
115 | |-------------------------------------------------------------------------- | ||
116 | | | ||
117 | | IE users can execute webpages in the context of your website, which is | ||
118 | | a serious security risk. Below option will manage this for you. | ||
119 | | | ||
120 | */ | ||
121 | noopen: true, | ||
122 | |||
123 | /* | ||
124 | |-------------------------------------------------------------------------- | ||
125 | | CSRF Protection | ||
126 | |-------------------------------------------------------------------------- | ||
127 | | | ||
128 | | CSRF Protection adds another layer of security by making sure, actionable | ||
129 | | routes does have a valid token to execute an action. | ||
130 | | | ||
131 | */ | ||
132 | csrf: { | ||
133 | enable: true, | ||
134 | methods: ['POST', 'PUT', 'DELETE'], | ||
135 | filterUris: [], | ||
136 | cookieOptions: { | ||
137 | httpOnly: false, | ||
138 | sameSite: true, | ||
139 | path: '/', | ||
140 | maxAge: 7200, | ||
141 | }, | ||
142 | }, | ||
143 | }; | ||