hansjone/netx
1
0
Fork 0
mirror of https://github.com/hansjone/netx.git synced 2026-10-08 23:33:21 +08:00
Code Issues Projects Releases 1 Packages Wiki Activity Actions 4

Default UME TLS verify off for lab self-signed certs.

Browse source 
Restore ume_verify_tls=false so onsite UME login works without a .env override; production should set NETX_UME_VERIFY_TLS=true or pin a CA.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
oliver 2026-08-06 15:15:48 +08:00
parent 0ebf137776
commit 6eeaa457b8
5 changed files with 6 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
PROD_MIN_CHECKLIST.md
View file

@ -3,7 +3,7 @@
## Security
- Prefer empty `NETX_AUTH_SECRET` so each install auto-writes `data/auth/jwt_secret` (do not commit that file). Set an explicit secret only for multi-node shared signing.
- Leave `NETX_DOCS_ENABLED` unset/false so `/docs` and OpenAPI stay off (set `true` only in lab).
- Keep `NETX_UME_VERIFY_TLS=true` (or pin a CA); avoid `false` on non-lab hosts.
- Set `NETX_UME_VERIFY_TLS=true` (or pin a CA) in production; default is `false` for lab self-signed UME.
- Binding `NETX_HOST` to a non-loopback address with lab defaults is refused unless `NETX_ALLOW_INSECURE_DEFAULTS=1`.
- Prefer scoped API tokens (MCP default excludes `webcrt:session` / `sql:query`).
- Keep `.env` and `oclaw/_local/system.env` out of Git (already ignored).