feat: harden authenticated deployment

2026-07-29 22:04:40 -04:00
parent 432dd2176f
commit 892479dceb
20 changed files with 3677 additions and 1298 deletions
@@ -1,4 +1,8 @@
 # Generate each with: openssl rand -base64 48
 POSTGRES_PASSWORD=
-# One-use secret to create [email protected]; remove after bootstrap.
+# One-use secret to create [email protected]; leave blank/remove after bootstrap.
 BOOTSTRAP_SETUP_TOKEN=
+# Optional host path mounted read-only at /home/node/.pi/agent (never commit it).
+PI_AGENT_CONFIG_DIR=./appdata/pi-agent
+# Optional explicit reverse-proxy IP/CIDR; leave blank if no trusted proxy is present.
+TRUST_PROXY=