mirror of
https://github.com/AletheiaVox/signal_bridge_remote.git
synced 2026-10-07 03:18:17 +08:00
6a8bc353c5
Publishes server work that shipped in the Android edition but never made it to this repo: - Full OAuth 2.0 flow (discovery metadata, dynamic client registration, authorize + token endpoints) so claude.ai remote connectors and the Android app can authenticate per-user instead of relying on the sole-phone fallback. - Safety governor: server-side heat model (intensity x time) with automatic cooldown, per-user overrides via GET/POST /safety/config, and governor state piggybacked on heartbeat pings so relay clients can display it. - SB_REQUIRE_MCP_AUTH env flag for multi-user deployments (disables the unauthenticated sole-phone fallback). - requirements-phone.txt and .env.example documenting the new knobs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
61 lines
3.1 KiB
Plaintext
61 lines
3.1 KiB
Plaintext
# Signal Bridge Remote — Environment Configuration
|
||
# Copy this to .env and fill in your values.
|
||
|
||
# ═══ REQUIRED ═══════════════════════════════════════════════════════════
|
||
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
|
||
SB_SECRET_KEY=your-secret-key-here
|
||
|
||
# ═══ Server ═════════════════════════════════════════════════════════════
|
||
SB_HOST=0.0.0.0
|
||
SB_PORT=8420
|
||
|
||
# ═══ Auth ═══════════════════════════════════════════════════════════════
|
||
# Set to "false" to lock out new registrations after your users are set up
|
||
SB_REGISTRATION_OPEN=true
|
||
# How long login tokens last (hours)
|
||
SB_TOKEN_EXPIRY_HOURS=168
|
||
# Set to "true" to require OAuth/token auth on every MCP request (multi-user
|
||
# servers). Default "false" keeps the single-user convenience fallback: an
|
||
# unauthenticated MCP request is routed to the sole connected phone session.
|
||
SB_REQUIRE_MCP_AUTH=false
|
||
|
||
# ═══ Rate Limiting (anti-harassment) ════════════════════════════════════
|
||
# Auth endpoint: strict to prevent credential stuffing
|
||
SB_RATE_LIMIT_AUTH=5/minute
|
||
# Command endpoint: generous for normal use, blocks floods
|
||
SB_RATE_LIMIT_COMMANDS=120/minute
|
||
# Global per-IP limit
|
||
SB_RATE_LIMIT_GLOBAL=300/minute
|
||
# Max WebSocket connections per IP
|
||
SB_MAX_WS_PER_IP=3
|
||
# Auto-ban after N failed auth attempts (per IP, 1-hour window)
|
||
SB_BAN_THRESHOLD=20
|
||
# How long bans last (minutes)
|
||
SB_BAN_DURATION_MINUTES=30
|
||
|
||
# ═══ Safety ═════════════════════════════════════════════════════════════
|
||
# How often to ping phones (seconds)
|
||
SB_HEARTBEAT_INTERVAL=2.0
|
||
# How long before declaring a phone dead (seconds)
|
||
SB_HEARTBEAT_TIMEOUT=6.0
|
||
|
||
# ═══ Governor (session intensity limiter) ═══════════════════════════════
|
||
# Heat accumulates from intensity × time and dissipates when idle; when it
|
||
# hits the threshold the governor forces a cooldown. Server-wide defaults —
|
||
# each user can override via GET/POST /safety/config.
|
||
SB_GOVERNOR_ENABLED=true
|
||
# Heat units/second at intensity 1.0
|
||
SB_GOVERNOR_HEAT_RATE=3.0
|
||
# Heat units/second dissipated when idle
|
||
SB_GOVERNOR_COOL_RATE=2.0
|
||
# Heat % that triggers cooldown
|
||
SB_GOVERNOR_COOLDOWN_ENTER=90.0
|
||
# Heat % at which cooldown may end
|
||
SB_GOVERNOR_COOLDOWN_EXIT=30.0
|
||
# Minimum seconds a cooldown lasts
|
||
SB_GOVERNOR_COOLDOWN_DURATION=30.0
|
||
|
||
# ═══ Database ═══════════════════════════════════════════════════════════
|
||
# SQLite file path (auto-created)
|
||
SB_DB_PATH=./signal_bridge.db
|