mirror of
https://github.com/This-weiyuqing/mi-fitness-health.git
synced 2026-10-17 18:55:37 +08:00
binglua
a47a8470f8
- CORS: default localhost-only origins (was *, allowed any webpage to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS - Host header allowlist middleware on FastAPI and Flask (DNS-rebinding protection); auto-configured for non-loopback binds via CLI - Move API key passTokens from SQLite plaintext to system keyring, with automatic migration on startup and cleanup for revoked keys - Disable uvicorn access log by default (query params out of terminals) - New GET /api/export: JSON/CSV export of local data (offline, Excel BOM) - Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory, threat model, self-verification steps - 6 new tests (host allowlist, keyring roundtrip, CSV)
21 lines
1.1 KiB
Bash
21 lines
1.1 KiB
Bash
# 运行时环境变量示例（可选；均由服务进程读取，不要把真实值提交进仓库）
|
||
|
||
# --- REST API (mi-fitness-mcp api) / Web 仪表盘 (mi-fitness-mcp web) ---
|
||
# 设置后所有数据端点要求 X-API-Key 头（防止本机其他进程/局域网读取健康数据）
|
||
# MI_FITNESS_API_KEY=change-me
|
||
# 管理端点（Key 发放/列表/吊销、扫码登录）要求 X-Admin-Key；未设置时仅限 127.0.0.1 调用
|
||
# MI_FITNESS_ADMIN_KEY=change-me
|
||
# Host 头白名单（防 DNS 重绑定），逗号分隔；非回环绑定时 CLI 会自动设置，一般无需手动配置
|
||
# MI_FITNESS_ALLOWED_HOSTS=127.0.0.1,localhost
|
||
# CORS 来源白名单（默认仅本机来源）；如需放开给指定前端才配置，慎用 *
|
||
# MI_FITNESS_CORS_ORIGINS=http://localhost:3000
|
||
|
||
# --- Web 仪表盘 (mi-fitness-mcp web) ---
|
||
# MI_FITNESS_API_URL=http://127.0.0.1:8321 # 反向代理的后端 FastAPI 地址
|
||
|
||
# --- Rust 测试页 (testpage/) ---
|
||
# BIND=127.0.0.1:8322 # 监听地址
|
||
# MI_FITNESS_API_URL=http://127.0.0.1:8321
|
||
|
||
# 小米凭据不走环境变量：用 mi-fitness-mcp setup（keyring 存储）或扫码登录发放 Key。
|