jcoffey-dev
98e105efd6
Cap JSON bodies at 64 KB on every API route except JMAP and uploads, which bound themselves. Sign-in used to read a body of any size before its rate limits ran; the flood ceiling now also runs before the body is read. For sessions whose JMAP requests are checked, lower the read cap from 16 MB to 4 MB, allow four such reads per session at once, and turn requests away with a 503 once 32 MB is held across everyone. Count sign-in limits per /64 for IPv6, since one host holds a whole /64. Bind the compose example to loopback, and run it read-only with no capabilities and no-new-privileges. Keep .env.* out of git and the image build context.
10 lines
168 B
Plaintext
10 lines
168 B
Plaintext
node_modules
|
|
**/node_modules
|
|
**/dist
|
|
.git
|
|
.env
|
|
# deploy.example.sh keeps its settings in .env.production; any .env.* holds APP_SECRET.
|
|
.env.*
|
|
!.env.example
|
|
server/data
|