mirror of
https://github.com/MichMich/MagicMirror.git
synced 2026-04-23 14:27:01 +00:00
9dd964e004
## Loading `config.js` ### Previously Loaded on server-side in `app.js` and in the browser by including `config.js` in `index.html`. The web server has an endpoint `/config` providing the content of server loaded `config.js`. ### Now Loaded only on server-side in `app.js`. The browser loads the content using the web server endpoint `/config`. So the server has control what to provide to the clients. Loading the `config.js` was moved to `Utils.js` so that `check_config.js` can use the same functions. ## Using environment variables in `config.js` ### Previously Environment variables were not allowed in `config.js`. The workaround was to create a `config.js.template` with curly braced bash variables allowed. While starting the app the `config.js.template` was converted via `envsub` into a `config.js`. ### Now Curly braced bash variables are allowed in `config.js`. Because only the server loads `config.js` he can substitute the variables while loading. ## Secrets in MagicMirror² To be honest, this is a mess. ### Previously All content defined in the `config` directory was reachable from the browser. Everyone with access to the site could see all stuff defined in the configuration e.g. using the url http://ip:8080/config. This included api keys and other secrets. So sharing a MagicMirror² url to others or running MagicMirror² without authentication as public website was not possible. ### Now With this PR we add (beta) functionality to protect sensitive data. This is only possible for modules running with a `node_helper`. For modules running in the browser only (e.g. default `weather` module), there is no way to hide data (per construction). This does not mean, that every module with `node_helper` is safe, e.g. the default `calendar` module is not safe because it uses the calendar url's as sort of id and sends them to the client. For adding more security you have to set `hideConfigSecrets: true` in `config.js`. With this: - `config/config.env` is not deliverd to the browser - the contents of environment variables beginning with `SECRET_` are not published to the clients This is a first step to protect sensitive data and you can at least protect some secrets.
84 lines
2.3 KiB
JavaScript
84 lines
2.3 KiB
JavaScript
/* global mmPort */
|
|
|
|
const address = "localhost";
|
|
let port = 8080;
|
|
if (typeof mmPort !== "undefined") {
|
|
port = mmPort;
|
|
}
|
|
const defaults = {
|
|
address: address,
|
|
port: port,
|
|
basePath: "/",
|
|
electronOptions: {},
|
|
ipWhitelist: ["127.0.0.1", "::ffff:127.0.0.1", "::1"],
|
|
|
|
language: "en",
|
|
logLevel: ["INFO", "LOG", "WARN", "ERROR"],
|
|
timeFormat: 24,
|
|
units: "metric",
|
|
zoom: 1,
|
|
customCss: "config/custom.css",
|
|
foreignModulesDir: "modules",
|
|
defaultModulesDir: "defaultmodules",
|
|
hideConfigSecrets: false,
|
|
// httpHeaders used by helmet, see https://helmetjs.github.io/. You can add other/more object values by overriding this in config.js,
|
|
// e.g. you need to add `frameguard: false` for embedding MagicMirror in another website, see https://github.com/MagicMirrorOrg/MagicMirror/issues/2847
|
|
httpHeaders: { contentSecurityPolicy: false, crossOriginOpenerPolicy: false, crossOriginEmbedderPolicy: false, crossOriginResourcePolicy: false, originAgentCluster: false },
|
|
|
|
// properties for checking if server is alive and has same startup-timestamp, the check is per default enabled
|
|
// (interval 30 seconds). If startup-timestamp has changed the client reloads the magicmirror webpage.
|
|
checkServerInterval: 30 * 1000,
|
|
reloadAfterServerRestart: false,
|
|
|
|
modules: [
|
|
{
|
|
module: "updatenotification",
|
|
position: "top_center"
|
|
},
|
|
{
|
|
module: "helloworld",
|
|
position: "upper_third",
|
|
classes: "large thin",
|
|
config: {
|
|
text: "MagicMirror²"
|
|
}
|
|
},
|
|
{
|
|
module: "helloworld",
|
|
position: "middle_center",
|
|
config: {
|
|
text: "Please create a config file or check the existing one for errors."
|
|
}
|
|
},
|
|
{
|
|
module: "helloworld",
|
|
position: "middle_center",
|
|
classes: "small dimmed",
|
|
config: {
|
|
text: "See README for more information."
|
|
}
|
|
},
|
|
{
|
|
module: "helloworld",
|
|
position: "middle_center",
|
|
classes: "xsmall",
|
|
config: {
|
|
text: "If you get this message while your config file is already created,<br>" + "it probably contains an error. To validate your config file run in your MagicMirror² directory<br>" + "<pre>node --run config:check</pre>"
|
|
}
|
|
},
|
|
{
|
|
module: "helloworld",
|
|
position: "bottom_bar",
|
|
classes: "xsmall dimmed",
|
|
config: {
|
|
text: "https://magicmirror.builders/"
|
|
}
|
|
}
|
|
]
|
|
};
|
|
|
|
/*************** DO NOT EDIT THE LINE BELOW ***************/
|
|
if (typeof module !== "undefined") {
|
|
module.exports = defaults;
|
|
}
|