Aktueller Stand

.env

@@ -1,28 +1,64 @@
+# --- Runtime ---
+NODE_ENV=production
+AUTO_MIGRATE=true
+
 # --- Ports (host bindings) ---
+BIND_IP=127.0.0.1
 API_PORT=8201
 WEB_PORT=3201
 
 # Public API URL used by the frontend (browser). Set to http(s)://<host>:<api-port>
-VITE_API_URL=http://docker:8201
+VITE_API_URL=https://api.mailcleaner.srv.medeba-media.de
+VITE_CLEANUP_ENABLED=true
 
 # Allow Vite dev server to accept requests for these hostnames (comma-separated)
-VITE_ALLOWED_HOSTS=docker
+VITE_ALLOWED_HOSTS=mailcleaner.srv.medeba-media.de,api.mailcleaner.srv.medeba-media.de
 
 # If running behind a reverse proxy (e.g. Nginx Proxy Manager), enable this
-TRUST_PROXY=false
+TRUST_PROXY=true
+WEB_BASE_URL=https://mailcleaner.srv.medeba-media.de
 
 # --- Database / Queue ---
 DATABASE_URL=postgresql://mailcleaner:mailcleaner@postgres:5432/mailcleaner
 REDIS_URL=redis://redis:6379
 
 # JWT signing secret for auth
-JWT_SECRET=dev-change-me
+JWT_SECRET=P50zRZNRV1e8sbCxOmhGy+S5S+5HAnozYjcXQ8YR0tJbdZbSD2q198lckaxkOg/O
+
+# Allowed CORS origins (comma-separated). Required in production.
+CORS_ORIGINS=https://mailcleaner.srv.medeba-media.de
+
+# Enable Swagger docs (/docs). Keep false in production.
+ENABLE_SWAGGER=false
+
+# Global rate limit
+RATE_LIMIT_MAX=300
+RATE_LIMIT_WINDOW=1 minute
+
+# Auth-specific rate limit
+RATE_LIMIT_AUTH_MAX=10
+RATE_LIMIT_AUTH_WINDOW=1 minute
+
+# Short-lived SSE token TTL (seconds)
+SSE_TOKEN_TTL_SECONDS=300
+
+# OAuth state TTL (seconds)
+OAUTH_STATE_TTL_SECONDS=600
+
+# Disallow custom IMAP/SMTP hosts unless explicitly enabled
+ALLOW_CUSTOM_MAIL_HOSTS=false
+
+# Block private network targets for unsubscribe HTTP
+BLOCK_PRIVATE_NETWORKS=true
+
+# Encryption key for sensitive secrets (set in production)
+ENCRYPTION_KEY=t6ay7IQvSWBbMKOX4S23S4BIcZ9b31eAhF9E9/Xe2tN5J8bmjbbyv+hHYBd6aMP8
 
 # --- Google OAuth (Gmail) ---
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
 # Must match the OAuth redirect URL configured in Google Cloud Console
-GOOGLE_REDIRECT_URI=http://docker:8201/oauth/gmail/callback
+GOOGLE_REDIRECT_URI=https://api.mailcleaner.srv.medeba-media.de/oauth/gmail/callback
 
 # --- Export jobs ---
 # Where export ZIPs are stored by the worker
@@ -32,8 +68,8 @@ EXPORT_TTL_HOURS=24
 
 # --- Seed admin account ---
 SEED_ADMIN_EMAIL=admin@simplemailcleaner.local
-SEED_ADMIN_PASSWORD=change-me-now
+SEED_ADMIN_PASSWORD=abfkFHbf<EFBFBD>bi3FBAkbekh34d
 SEED_TENANT=Default Tenant
 SEED_TENANT_ID=seed-tenant
-SEED_ENABLED=true
+SEED_ENABLED=false
 SEED_FORCE_PASSWORD_UPDATE=false