root
be0750d001
- Magic-link auth (sha256-only token storage, 15-min single-use, 7-day sessions) - Staff-key auth via X-DRE-Staff-Key (constant-time compare) - SQLite WAL, foreign_keys, parameterized queries, atomic DRE/CLT sequence allocation - Intake validator rejects SSN/PAN patterns (FDCPA/TDCPA compliance) - Document upload allowlist + magic-byte check, 20MB cap - Unified error envelope, money as integer cents - systemd unit (port 8093, User=root, hardening directives) - Fixes import bug (auth.py relative imports) and audit_log placeholder mismatch
23 lines
608 B
Desktop File
23 lines
608 B
Desktop File
[Unit]
|
|
Description=DRE Customer Portal API (FastAPI/uvicorn)
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
WorkingDirectory=/opt/dre-portal
|
|
EnvironmentFile=/opt/dre-portal/.env
|
|
ExecStart=/opt/dre-portal/venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8093
|
|
Restart=on-failure
|
|
RestartSec=3
|
|
User=root
|
|
# hardening
|
|
NoNewPrivileges=true
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ReadWritePaths=/opt/dre-portal/data
|
|
# NOTE: ProtectHome=true would block reading /root; omitted so service can read env.
|
|
# (ops-portal.service runs as root without ProtectHome for the same reason.)
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|