Harden and rewrite for release

2026-08-27 17:24:54 +01:00
parent 7e28074eff
commit d817b971e0
22 changed files with 719 additions and 1133 deletions
@@ -0,0 +1,42 @@
+# Copy to ~/.config/rex/server.toml on the server, then replace every secret.
+# Rex writes this file with mode 0600 when it creates or updates it.
+
+# Public API listener. Keep 127.0.0.1 when Nginx terminates TLS on this host.
+public_host = "127.0.0.1"
+public_port = 8010
+
+# Internal status API. Do not expose this through a reverse proxy.
+management_host = "127.0.0.1"
+management_port = 8011
+
+# Uncomment both lines only if Rex, rather than a reverse proxy, terminates TLS.
+# tls_certfile = "/etc/letsencrypt/live/rex.example.net/fullchain.pem"
+# tls_keyfile = "/etc/letsencrypt/live/rex.example.net/privkey.pem"
+
+# Per direct peer address, over a rolling 60-second window.
+rate_limit_per_minute = 120
+
+# Individual IP addresses and CIDR networks are accepted.
+blacklist = ["203.0.113.24", "198.51.100.0/24"]
+
+# Only listed names may connect a device WebSocket.
+devices = ["desk"]
+
+# Use a distinct secret for each role. Generate production keys with:
+#   rex server keys create <name> --permission <connect|execute|admin>
+[[keys]]
+name = "desk-client"
+secret = "REPLACE_WITH_A_CONNECT_KEY"
+permissions = ["connect"]
+
+[[keys]]
+name = "automation"
+secret = "REPLACE_WITH_AN_EXECUTE_KEY"
+permissions = ["execute"]
+
+# Optional: this key can access the loopback-only management status API and
+# also has connect and execute rights. Do not use it in a client or automation.
+[[keys]]
+name = "local-admin"
+secret = "REPLACE_WITH_AN_ADMIN_KEY"
+permissions = ["admin"]