Add security fixes and comprehensive documentation

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-02-06 21:59:19 +00:00
parent 47154c28d2
commit 9ea40bec61
12 changed files with 2254 additions and 34 deletions
@@ -0,0 +1,118 @@
+# Quizzical Beats - Environment Variables Example
+# Copy this file to .env and replace with your actual values
+# SECURITY NOTE: Never commit .env file to version control!
+
+# ============================================================================
+# CRITICAL SECURITY SETTINGS - MUST BE SET
+# ============================================================================
+
+# Secret key for Flask session management (REQUIRED)
+# Generate with: python -c 'import secrets; print(secrets.token_hex(32))'
+SECRET_KEY=
+
+# Automation token for API endpoints (REQUIRED)
+# Generate with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
+AUTOMATION_TOKEN=
+
+# ============================================================================
+# DEBUG SETTINGS
+# ============================================================================
+# WARNING: Set DEBUG=False in production environments!
+DEBUG=False
+DEBUG2=False
+
+# ============================================================================
+# DATABASE CONFIGURATION
+# ============================================================================
+SQLALCHEMY_DATABASE_URI=sqlite:///data/song_data.db
+SQLALCHEMY_TRACK_MODIFICATIONS=False
+
+# ============================================================================
+# HTTPS CONFIGURATION
+# ============================================================================
+# Set to True when running behind a reverse proxy with HTTPS (e.g., Traefik, nginx)
+USE_HTTPS=False
+# PREFERRED_URL_SCHEME=https
+
+# ============================================================================
+# SPOTIFY API CONFIGURATION (REQUIRED)
+# ============================================================================
+# Get credentials from: https://developer.spotify.com/dashboard/applications
+SPOTIFY_CLIENT_ID=
+SPOTIFY_CLIENT_SECRET=
+SPOTIFY_REDIRECT_URI=http://localhost:5000/auth/spotify/callback
+
+# ============================================================================
+# MUSIC METADATA APIs
+# ============================================================================
+# Last.fm API for genre enrichment (REQUIRED)
+# Get from: https://www.last.fm/api/account/create
+LASTFM_API_KEY=
+
+# ============================================================================
+# DEEZER API CONFIGURATION (OPTIONAL)
+# ============================================================================
+# Get credentials from: https://developers.deezer.com/myapps
+DEEZER_APP_ID=
+DEEZER_APP_SECRET=
+DEEZER_REDIRECT_URI=http://localhost:5000/deezer-callback
+
+# ============================================================================
+# OAUTH PROVIDERS (OPTIONAL)
+# ============================================================================
+
+# Google OAuth
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# Authentik OAuth (self-hosted SSO)
+AUTHENTIK_CLIENT_ID=
+AUTHENTIK_CLIENT_SECRET=
+AUTHENTIK_METADATA_URL=
+
+# Dropbox OAuth (for cloud export)
+DROPBOX_APP_KEY=
+DROPBOX_APP_SECRET=
+DROPBOX_REDIRECT_URI=http://localhost:5000/users/dropbox/callback
+
+# ============================================================================
+# AI SERVICES (OPTIONAL)
+# ============================================================================
+# OpenAI API for quiz generation features
+OPENAI_API_KEY=
+OPENAI_URL=https://api.openai.com/v1
+OPENAI_MODEL=gpt-4o-mini
+OPENAI_SEARCH_MODEL=gpt-4o-mini-search-preview
+
+# ElevenLabs API for voice generation
+ELEVENLABS_API_KEY=
+
+# Translation services (optional)
+DEEPL_API_KEY=
+MEANINGCLOUD_API_KEY=
+
+# ACRCloud for audio fingerprinting (optional)
+ACRCLOUD_TOKEN=
+
+# ============================================================================
+# EMAIL CONFIGURATION (OPTIONAL)
+# ============================================================================
+MAIL_HOST=smtp.example.com
+MAIL_PORT=587
+MAIL_USE_TLS=True
+MAIL_USE_SSL=False
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_SENDER=quizzical-beats@example.com
+MAIL_RECIPIENT=admin@example.com
+
+# ============================================================================
+# ADVANCED CONFIGURATION (OPTIONAL)
+# ============================================================================
+# Static OAuth URLs for production (when behind complex reverse proxies)
+# STATIC_OAUTH_URLS=False
+# OAUTH_SPOTIFY_AUTH_URL=
+# OAUTH_SPOTIFY_LINK_URL=
+# OAUTH_GOOGLE_URL=
+# OAUTH_AUTHENTIK_URL=
+# OAUTH_DROPBOX_URL=