mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
69bae8bdb4
At a first start there is no recorded key yet, so an operator facing a refusal they are certain is false has no row to delete. With ENCRYPTION_KEY_CHECK=warn (default enforce) the check still runs and logs its full outcome, /api/health names a mismatch as a warning field without failing, requests are served, and no key is recorded unless every key id passes. The variable is on the compose whitelist, in both example files, the env manifest, the Unraid and Portainer templates and the published-env guard. The log block, the mismatch page and the self-hosting pages offer it as the last resort after the three real fixes, and say that it disables a safety check.
67 lines
2.9 KiB
JSON
67 lines
2.9 KiB
JSON
{
|
|
"version": "3",
|
|
"templates": [
|
|
{
|
|
"type": 3,
|
|
"title": "HealthLog",
|
|
"name": "healthlog",
|
|
"description": "Self-hosted personal health tracker (PWA + native iOS client): weight, blood pressure, pulse, blood glucose, body composition, sleep, mood, menstrual cycle, and medications on one encrypted timeline. AES-256-GCM at rest, no vendor cloud, no telemetry. Ships app + PostgreSQL 16 as one stack.",
|
|
"note": "Generate each secret with: openssl rand -hex 32 (a 64-char hex string). For plain-HTTP / LAN access set SESSION_COOKIE_SECURE to false, or login fails. Set NEXT_PUBLIC_APP_URL and APP_URL to how you reach the app. Full guide: https://github.com/MBombeck/HealthLog/blob/main/docs/self-hosting/getting-started.md",
|
|
"categories": ["Tools", "Other"],
|
|
"platform": "linux",
|
|
"logo": "https://raw.githubusercontent.com/MBombeck/HealthLog/main/public/logo-512.png",
|
|
"repository": {
|
|
"url": "https://github.com/MBombeck/HealthLog",
|
|
"stackfile": "docker-compose.yml"
|
|
},
|
|
"env": [
|
|
{
|
|
"name": "POSTGRES_PASSWORD",
|
|
"label": "PostgreSQL password",
|
|
"description": "Database password. Generate with: openssl rand -hex 32"
|
|
},
|
|
{
|
|
"name": "ENCRYPTION_KEY",
|
|
"label": "Encryption key (data at rest)",
|
|
"description": "AES-256-GCM key. Generate with: openssl rand -hex 32. Back this up — losing it makes encrypted data unrecoverable."
|
|
},
|
|
{
|
|
"name": "API_TOKEN_HMAC_KEY",
|
|
"label": "API token HMAC key",
|
|
"description": "Generate with: openssl rand -hex 32"
|
|
},
|
|
{
|
|
"name": "HEALTHLOG_PLATFORM",
|
|
"label": "Platform hint",
|
|
"description": "Opens the admin's encryption key backup step on the Portainer instructions.",
|
|
"default": "portainer"
|
|
},
|
|
{
|
|
"name": "ENCRYPTION_KEY_CHECK",
|
|
"label": "Encryption key check",
|
|
"description": "enforce refuses to serve when the key does not open the stored data. warn only logs it: a last resort for a refusal you are certain is false; it disables a safety check.",
|
|
"default": "enforce"
|
|
},
|
|
{
|
|
"name": "SESSION_COOKIE_SECURE",
|
|
"label": "Session cookie Secure flag",
|
|
"description": "Set to false for plain-HTTP / LAN access, or login fails. Set to true only behind an HTTPS reverse proxy.",
|
|
"default": "false"
|
|
},
|
|
{
|
|
"name": "NEXT_PUBLIC_APP_URL",
|
|
"label": "Public app URL",
|
|
"description": "How users reach HealthLog, e.g. http://nas:3000 or https://healthlog.example.com",
|
|
"default": "http://localhost:3000"
|
|
},
|
|
{
|
|
"name": "APP_URL",
|
|
"label": "Internal app URL",
|
|
"description": "Normally identical to the public app URL.",
|
|
"default": "http://localhost:3000"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|