config.py.example

# Statement for enabling the development environment
DEBUG = True

# Define the application directory
import os
BASE_DIR = os.path.abspath(os.path.dirname(__file__))

# Photo archive directory
# local
LOCALARCHIVEPATH='static/cigarbox'
REMOTEARCHIVEPATH='static/cigarbox'

# API
UPLOAD_FOLDER='/tmp/cigarbox'
#ALLOWED_EXTENSIONS = ['jpg']
ALLOWED_EXTENSIONS = ['mov', 'mp4', 'png', 'jpg', 'jpeg', 'gif', 'm4v']

# For directory tagging, ignore these directories/tags
IGNORETAGS = ['Users','username','Pictures','exports','events']

# AWS Credentials
# IMPORTANT: Never commit real credentials to git!
# Get your credentials from https://console.aws.amazon.com/iam/
AWS_ACCESS_KEY_ID = 'YOUR_AWS_ACCESS_KEY_ID'
AWS_SECRET_ACCESS_KEY = 'YOUR_AWS_SECRET_ACCESS_KEY'
S3_BUCKET_NAME='your-bucket-name'
# Should we store your originals publicly? Probably not
AWSPOLICY = 'private'

# Define the database - we are working with
# SQLite for this example

DATABASE={'name'  :'photos.db',
          'engine':'peewee.SqliteDatabase'}

# Secret Key
# IMPORTANT: Change this to a random string in production!
# Generate with: python -c 'import secrets; print(secrets.token_hex(32))'
SECRET_KEY='change-this-to-a-random-secret-key'

# API Configuration
# API Key for authentication
# IMPORTANT: Change this to a secure random key!
# Generate with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
API_KEY='your-api-key-here'

# API URL for cli/upload.py script (optional, defaults to localhost)
# For production with subpath: 'https://yourdomain.com/pictures/api'
# For local Docker testing: 'http://localhost:8088/api'
# Can also be set via CIGARBOX_API_URL environment variable
# API_URL='http://localhost:9601/api'

# Nginx Configuration (for production deployments)
# Used by fabric tasks to find nginx logs
# Set NGINX_DOMAIN to your domain name (e.g., 'example.com')
# Logs will be checked at /var/log/nginx/{domain}-access.log and {domain}-error.log
NGINX_DOMAIN = None  # e.g., 'example.com' or None to skip domain-specific logs

# Flask-Security-Too Configuration
# IMPORTANT: Change SECURITY_PASSWORD_SALT to a random string in production!
# Generate with: python -c 'import secrets; print(secrets.token_hex(32))'
SECURITY_PASSWORD_SALT = 'change-this-to-a-random-salt'
SECURITY_PASSWORD_HASH = 'bcrypt'
SECURITY_PASSWORD_SINGLE_HASH = True  # Use plain bcrypt without HMAC wrapper
SECURITY_REGISTERABLE = False  # Only admins can create users
SECURITY_SEND_REGISTER_EMAIL = False
SECURITY_TRACKABLE = False  # Disable login tracking (requires additional DB fields)
SECURITY_CHANGEABLE = True  # Allow password changes
SECURITY_RECOVERABLE = False  # No email-based password recovery (for now)
SECURITY_USE_PERMISSIONS = False  # Disable Flask-Principal permissions system
SECURITY_LOGIN_URL = '/login'
SECURITY_LOGOUT_URL = '/logout'
SECURITY_POST_LOGIN_VIEW = '/'
SECURITY_POST_LOGOUT_VIEW = '/'

# Session Configuration - Keep users logged in for 360 days
from datetime import timedelta
PERMANENT_SESSION_LIFETIME = timedelta(days=360)
SESSION_COOKIE_SECURE = False  # Set to True if using HTTPS
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'

# Bot Protection - Require login to view photos
# Set to True to block public access (temporary until PoW is implemented)
# Set to False to allow public viewing (with privacy levels)
REQUIRE_AUTH_FOR_PHOTOS = False

# Proof-of-Work (PoW) Bot Protection
POW_ENABLED = False  # Enable PoW CAPTCHA for unauthenticated users
POW_DIFFICULTY = 4  # Leading zeros in hex (4 = ~2 sec, 5 = ~30 sec, 6 = ~8 min)
POW_CHALLENGE_EXPIRY = 300  # Challenge expires after 5 minutes (seconds)
POW_TOKEN_EXPIRY_DAYS = 30  # DEPRECATED - Not used anymore (use POW_TOKEN_EXPIRY_MINUTES)
POW_TOKEN_EXPIRY_MINUTES = 15  # Token expires after N minutes (time-based expiry)
POW_TOKEN_MAX_REQUESTS = 5  # Max page views per token (set low for testing, 50+ for production)
POW_BIND_TO_IP = True  # Invalidate token if IP changes (breaks mobile switching networks)
POW_SKIP_AUTHENTICATED = True  # Skip PoW for logged-in users
POW_ALLOW_PRIVACY_PROXIES = True  # Exempt privacy proxies (iCloud Private Relay, etc) from IP binding
POW_PRIVACY_PROXY_RANGES = [
    '104.28.',  # Cloudflare (used by iCloud Private Relay)
    '104.29.',  # Cloudflare (used by iCloud Private Relay)
    '172.225.', # Akamai (used by iCloud Private Relay)
]  # IP prefixes that are exempt from IP binding when POW_ALLOW_PRIVACY_PROXIES=True
POW_SPLIT_BRAIN_PHOTOS = True  # Show preview + OG tags even without POW token (200 response), or return 403

PRIVACYFLAGS = {'public':0, 'friends':1, 'family':2, 'private':8, 'disabled':9}

# Thumbnail sizes for different uses
# Options: t=100px, m=240px, n=320px, k=500px, c=800px, b=1024px
# Privacy strategy: t,m,n are public (too small for AI), k,c,b are private (protected)
GALLERY_THUMBNAIL_SIZE = 'n'   # Gallery grid thumbnails (n=320px, public, AI-safe)
OPENGRAPH_IMAGE_SIZE = 'n'     # Social media preview images (n=320px, too small for AI)

# S3 signed URL expiry
S3_SIGNED_URL_EXPIRY = 300  # 5 minutes (300 seconds) - balance security vs user experience

PER_PAGE=100

PORT=9600
# SITEURL is dynamically generated by get_base_url()

# Application threads. A common general assumption is
# using 2 per available processor cores - to handle
# incoming requests using one and performing background
# operations using the other.
THREADS_PER_PAGE = 2

# Enable protection agains *Cross-site Request Forgery (CSRF)*
CSRF_ENABLED     = True

# Use a secure, unique and absolutely secret key for
# signing the data.
CSRF_SESSION_KEY = 'secret'

# Secret key for signing cookies
SECRET_KEY = 'secret'

# Optional: Analytics script URL
# Set to None to disable analytics tracking
# Example: 'https://your-analytics-domain.com/analytics.js?code=YOUR_CODE'
ANALYTICS_SCRIPT_URL = None

#  MAX Upload Size
MAX_CONTENT_LENGTH = 16 * 1024 * 1024