SHA256
jhkaktus
ae1af1f8d2
TLS termination belongs to the trusted reverse proxy in front (nginx/caddy/...), not the app. run.py now binds plain HTTP to 127.0.0.1 (HOST/PORT configurable) and the dirty rollback of the reverted self-signed-cert logic was cleaned up. README updated. Verified: all endpoints 200 over HTTP, integrity tests 3/3 passing. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
26 lines
595 B
Python
26 lines
595 B
Python
"""Entrypoint. Runs the Flask app over plain HTTP on a local port.
|
|
|
|
TLS is NOT terminated here: a trusted reverse proxy (nginx/caddy/...)
|
|
in front handles HTTPS and forwards to this internal HTTP port. The
|
|
proxy must be the only thing reachable from outside; bind this app to
|
|
127.0.0.1 (or a private interface) only.
|
|
"""
|
|
|
|
import os
|
|
|
|
from backend.app import app
|
|
from backend import storage
|
|
|
|
|
|
def main():
|
|
storage.init_db()
|
|
|
|
host = os.environ.get("HOST", "127.0.0.1")
|
|
port = int(os.environ.get("PORT", "5000"))
|
|
|
|
app.run(host=host, port=port)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|