Security · Kanesh

The defaults are safe for a local install. Change these before you put Kanesh on the internet.

HTTPS and headers

Variable	Default	What it does
`COOKIE_SECURE`	`false`	Set `true` when Kanesh is served over HTTPS, including behind a TLS proxy. Cookies are then sent only over HTTPS.
`HSTS_ENABLED`	same as `COOKIE_SECURE`	Tells browsers to always use HTTPS for this host (180 days).
`CONTENT_SECURITY_POLICY`	strict, same-origin only	Replaces the Content-Security-Policy for Studio pages. API responses have none. Only change it if you embed Studio resources from elsewhere.
`TRUSTED_PROXIES`	unset	Proxies allowed to pass the real client IP in `X-Forwarded-For`, as IPs or CIDRs.

Note: Behind a reverse proxy, set TRUSTED_PROXIES to its network. Otherwise every visitor looks like the proxy and shares one rate limit.

Some settings saved in Studio are secrets, such as the SMTP password. Kanesh encrypts them with this key.

Variable	Default	What it does
`SETTINGS_ENCRYPTION_KEY`	unset	Encryption key, at least 16 characters. Without it, Studio cannot save secrets.
`SECRET`	unset	Fallback key, used only when `SETTINGS_ENCRYPTION_KEY` is unset.

Back the key up. If it changes, you have to enter every saved secret again. Never commit a real value.

Each client gets a request budget on /api/ that refills over time.

Variable	Default	What it does
`RATE_LIMIT_ENABLED`	`true`	`false` turns the limit off. Keep it on for public installs.
`RATE_LIMIT_POINTS`	`600`	Requests allowed per client in one window.
`RATE_LIMIT_DURATION`	`1m`	Length of the window.
`RATE_LIMIT_AUTH_POINTS`	`20`	Stricter budget for login and the installation claim.
`RATE_LIMIT_AUTH_DURATION`	`1m`	Window for that stricter budget.

When the budget runs out, the API returns 429 with a Retry-After header.