157 lines
6.5 KiB
Python
157 lines
6.5 KiB
Python
"""Application configuration."""
|
|
|
|
import os
|
|
from pathlib import Path
|
|
|
|
# Application version
|
|
VERSION = "1.5.0"
|
|
|
|
|
|
class Config:
|
|
"""Base configuration."""
|
|
|
|
BASE_DIR = Path(__file__).parent.parent
|
|
DATABASE = os.environ.get("FLASKPASTE_DB", BASE_DIR / "data" / "pastes.db")
|
|
PASTE_ID_LENGTH = int(os.environ.get("FLASKPASTE_ID_LENGTH", "12"))
|
|
|
|
# Paste size limits
|
|
# Minimum size enforces encryption overhead (IV + tag + ciphertext)
|
|
# AES-256-GCM: 12 byte IV + 16 byte tag = 28 bytes minimum, ~40 base64
|
|
MIN_PASTE_SIZE = int(os.environ.get("FLASKPASTE_MIN_SIZE", 0)) # 0 = disabled
|
|
MAX_PASTE_SIZE_ANON = int(os.environ.get("FLASKPASTE_MAX_ANON", 3 * 1024 * 1024)) # 3MiB
|
|
MAX_PASTE_SIZE_AUTH = int(os.environ.get("FLASKPASTE_MAX_AUTH", 50 * 1024 * 1024)) # 50MiB
|
|
MAX_CONTENT_LENGTH = MAX_PASTE_SIZE_AUTH # Flask request limit
|
|
|
|
# Paste expiry (tiered by authentication level)
|
|
# Anonymous users: shortest expiry (default 1 day)
|
|
EXPIRY_ANON = int(os.environ.get("FLASKPASTE_EXPIRY_ANON", 1 * 24 * 60 * 60))
|
|
# Untrusted certs (authenticated but not registered): medium expiry (default 7 days)
|
|
EXPIRY_UNTRUSTED = int(os.environ.get("FLASKPASTE_EXPIRY_UNTRUSTED", 7 * 24 * 60 * 60))
|
|
# Trusted certs (registered in PKI): longest expiry (default 30 days, 0 = no expiry)
|
|
EXPIRY_TRUSTED = int(os.environ.get("FLASKPASTE_EXPIRY_TRUSTED", 30 * 24 * 60 * 60))
|
|
# Maximum custom expiry (default 90 days, 0 = unlimited for trusted)
|
|
MAX_EXPIRY_SECONDS = int(os.environ.get("FLASKPASTE_MAX_EXPIRY", 90 * 24 * 60 * 60))
|
|
# Legacy alias for backwards compatibility
|
|
PASTE_EXPIRY_SECONDS = EXPIRY_ANON
|
|
|
|
# Content deduplication / abuse prevention
|
|
# Throttle repeated submissions of identical content
|
|
CONTENT_DEDUP_WINDOW = int(os.environ.get("FLASKPASTE_DEDUP_WINDOW", 3600)) # 1 hour
|
|
CONTENT_DEDUP_MAX = int(os.environ.get("FLASKPASTE_DEDUP_MAX", 3)) # max 3 per window
|
|
|
|
# Minimum entropy requirement (0 = disabled)
|
|
# Encrypted data has ~7.5-8.0 bits/byte, plaintext ~4.0-5.0
|
|
# Set to 6.0+ to effectively require encryption
|
|
MIN_ENTROPY = float(os.environ.get("FLASKPASTE_MIN_ENTROPY", 0))
|
|
# Minimum size for entropy check (small data has unreliable entropy measurement)
|
|
MIN_ENTROPY_SIZE = int(os.environ.get("FLASKPASTE_MIN_ENTROPY_SIZE", 256))
|
|
|
|
# Require binary content (reject recognizable formats)
|
|
# Rejects content with known magic bytes (PNG, JPEG, PDF, etc.) and UTF-8 text.
|
|
REQUIRE_BINARY = os.environ.get("FLASKPASTE_REQUIRE_BINARY", "0").lower() in (
|
|
"1",
|
|
"true",
|
|
"yes",
|
|
)
|
|
|
|
# Reverse proxy trust configuration
|
|
# SECURITY: The X-SSL-Client-SHA1 header is trusted for authentication.
|
|
# This header MUST only come from a trusted reverse proxy that validates
|
|
# client certificates. Direct access to this app MUST be blocked.
|
|
#
|
|
# Set FLASKPASTE_PROXY_SECRET to require the proxy to send a matching
|
|
# X-Proxy-Secret header, providing defense-in-depth against header spoofing.
|
|
TRUSTED_PROXY_SECRET = os.environ.get("FLASKPASTE_PROXY_SECRET", "")
|
|
|
|
# Proof-of-work spam prevention
|
|
# Clients must solve a computational puzzle before paste creation.
|
|
# Difficulty is number of leading zero bits required in hash (0 = disabled).
|
|
POW_DIFFICULTY = int(os.environ.get("FLASKPASTE_POW_DIFFICULTY", "20"))
|
|
POW_CHALLENGE_TTL = int(os.environ.get("FLASKPASTE_POW_TTL", "300")) # 5 minutes
|
|
# Secret key for signing challenges (auto-generated if not set)
|
|
POW_SECRET = os.environ.get("FLASKPASTE_POW_SECRET", "")
|
|
# Registration PoW difficulty (higher than paste creation for security)
|
|
REGISTER_POW_DIFFICULTY = int(os.environ.get("FLASKPASTE_REGISTER_POW", "24"))
|
|
|
|
# Anti-flood: dynamically increase PoW difficulty under load
|
|
ANTIFLOOD_ENABLED = os.environ.get("FLASKPASTE_ANTIFLOOD", "1").lower() in (
|
|
"1",
|
|
"true",
|
|
"yes",
|
|
)
|
|
ANTIFLOOD_WINDOW = int(os.environ.get("FLASKPASTE_ANTIFLOOD_WINDOW", "60")) # seconds
|
|
ANTIFLOOD_THRESHOLD = int(os.environ.get("FLASKPASTE_ANTIFLOOD_THRESHOLD", "5")) # req/window
|
|
ANTIFLOOD_STEP = int(os.environ.get("FLASKPASTE_ANTIFLOOD_STEP", "2")) # bits per step
|
|
ANTIFLOOD_MAX = int(os.environ.get("FLASKPASTE_ANTIFLOOD_MAX", "28")) # max difficulty
|
|
ANTIFLOOD_DECAY = int(os.environ.get("FLASKPASTE_ANTIFLOOD_DECAY", "60")) # seconds to decay
|
|
|
|
# URL prefix for reverse proxy deployments (e.g., "/paste" for mymx.me/paste)
|
|
URL_PREFIX = os.environ.get("FLASKPASTE_URL_PREFIX", "").rstrip("/")
|
|
|
|
# IP-based rate limiting
|
|
# Limits paste creation per IP address using sliding window
|
|
RATE_LIMIT_ENABLED = os.environ.get("FLASKPASTE_RATE_LIMIT", "1").lower() in (
|
|
"1",
|
|
"true",
|
|
"yes",
|
|
)
|
|
RATE_LIMIT_WINDOW = int(os.environ.get("FLASKPASTE_RATE_WINDOW", "60")) # seconds
|
|
RATE_LIMIT_MAX = int(os.environ.get("FLASKPASTE_RATE_MAX", "10")) # requests per window
|
|
# Authenticated users get higher limits (multiplier)
|
|
RATE_LIMIT_AUTH_MULTIPLIER = int(os.environ.get("FLASKPASTE_RATE_AUTH_MULT", "5"))
|
|
|
|
# PKI Configuration
|
|
# Enable PKI endpoints for certificate authority and issuance
|
|
PKI_ENABLED = os.environ.get("FLASKPASTE_PKI_ENABLED", "0").lower() in ("1", "true", "yes")
|
|
# CA password for signing operations (REQUIRED when PKI is enabled)
|
|
PKI_CA_PASSWORD = os.environ.get("FLASKPASTE_PKI_CA_PASSWORD", "")
|
|
# Default validity period for issued certificates (days)
|
|
PKI_CERT_DAYS = int(os.environ.get("FLASKPASTE_PKI_CERT_DAYS", "365"))
|
|
# CA certificate validity period (days)
|
|
PKI_CA_DAYS = int(os.environ.get("FLASKPASTE_PKI_CA_DAYS", "3650")) # 10 years
|
|
|
|
|
|
class DevelopmentConfig(Config):
|
|
"""Development configuration."""
|
|
|
|
DEBUG = True
|
|
|
|
|
|
class ProductionConfig(Config):
|
|
"""Production configuration."""
|
|
|
|
DEBUG = False
|
|
|
|
|
|
class TestingConfig(Config):
|
|
"""Testing configuration."""
|
|
|
|
TESTING = True
|
|
DATABASE = ":memory:"
|
|
|
|
# Relaxed dedup for testing (100 per second window)
|
|
CONTENT_DEDUP_WINDOW = 1
|
|
CONTENT_DEDUP_MAX = 100
|
|
|
|
# Disable PoW for most tests (easier testing)
|
|
POW_DIFFICULTY = 0
|
|
|
|
# Relaxed rate limiting for tests
|
|
RATE_LIMIT_ENABLED = True
|
|
RATE_LIMIT_WINDOW = 1
|
|
RATE_LIMIT_MAX = 100
|
|
|
|
# PKI testing configuration
|
|
PKI_ENABLED = True
|
|
PKI_CA_PASSWORD = "test-ca-password"
|
|
PKI_CERT_DAYS = 30
|
|
PKI_CA_DAYS = 365
|
|
|
|
|
|
config = {
|
|
"development": DevelopmentConfig,
|
|
"production": ProductionConfig,
|
|
"testing": TestingConfig,
|
|
"default": DevelopmentConfig,
|
|
}
|