flightradar/.env.example at master · michaelmorandi/flightradar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# Flight Radar Environment Configuration
# Copy this file to .env and fill in your values

# =============================================================================
# FRONTEND CONFIGURATION
# =============================================================================

# API URL for the backend
VITE_FLIGHT_API_URL=http://localhost:8083/api/v1

# HERE Maps API Key for map rendering
VITE_HERE_API_KEY=your-here-api-key

# Client Secret for JWT Cookie Authentication
# IMPORTANT: Must match CLIENT_SECRET on the backend
# Used as password for the anonymous user login
# Generate a secure random string: openssl rand -hex 32
VITE_CLIENT_SECRET=your-client-secret-min-32-chars

# Mock data mode for development (true/false)
VITE_MOCK_DATA=false

# Enable position interpolation
VITE_ENABLE_INTERPOLATION=true

# =============================================================================
# BACKEND CONFIGURATION
# =============================================================================

# MongoDB Connection
MONGODB_URI=mongodb://localhost:27017/
MONGODB_DB_NAME=flightradar

# Database Retention (minutes)
DB_RETENTION_MIN=1440

# ADS-B Data Source Configuration
# Options: vrs, dump1090, grpc
SERVICE_TYPE=vrs

# gRPC Server Address (when SERVICE_TYPE=grpc)
GRPC_SERVER_ADDRESS=localhost:50051

# Data folder for aircraft database
DATA_FOLDER=resources

# Military aircraft only filter (true/false)
MIL_ONLY=false

# Unknown aircraft crawling (true/false)
UNKNOWN_AIRCRAFT_CRAWLING=false

# =============================================================================
# AUTHENTICATION CONFIGURATION (fastapi-users with JWT cookies)
# =============================================================================

# JWT Secret Key for signing tokens
# CRITICAL: Keep this secret! Generate a strong random string (32+ characters)
# Example: openssl rand -hex 32
JWT_SECRET=your-jwt-secret-min-32-chars

# Client Secret (password for anonymous user)
# Note: Backend also accepts VITE_CLIENT_SECRET, so you can use just one variable
# Example: openssl rand -hex 32
CLIENT_SECRET=your-client-secret-min-32-chars

# Allowed Frontend Origins (comma-separated)
# Leave empty for localhost defaults, or set your production domain(s)
# Example: https://flightradar.example.com,https://www.flightradar.example.com
ALLOWED_ORIGINS=

# =============================================================================
# SECURITY NOTES
# =============================================================================
#
# 1. Generate secure secrets:
#    - Use: openssl rand -hex 32
#    - Or: python3 -c "import secrets; print(secrets.token_hex(32))"
#
# 2. Use VITE_CLIENT_SECRET for both frontend and backend (simpler)
#
# 3. JWT_SECRET and CLIENT_SECRET should be different from each other
#
# 4. Never commit the .env file to version control
#
# 5. Rotate secrets periodically in production
#
# 6. Authentication uses HTTP-only cookies (15 min lifetime, auto-refresh)
#
# =============================================================================