headroom/.env.example

# Copy this file to .env and fill in real values before running.
# docker-compose.yml requires these — it will refuse to start with defaults.

# Neo4j credentials for the graph memory backend (format: user/password).
NEO4J_AUTH=neo4j/CHANGEME
# Password only, for library / non-Docker use of the Neo4j memory backend.
NEO4J_PASSWORD=CHANGEME

# Proxy token — gates the data plane whenever the proxy is not loopback-only.
# Generate: openssl rand -hex 32
HEADROOM_PROXY_TOKEN=CHANGEME

# Optional: set to 0.0.0.0 to expose the proxy on the network (requires a token).
# HEADROOM_BIND_ADDR=127.0.0.1
fix(security): address u9up assessment findings (WEB-01–07) (#2207) Hardens client-selected upstreams, memory identity resolution, downloaded binary integrity, telemetry import, Docker defaults, Neo4j credentials, and archive extraction. Refreshes the branch against current main and preserves newer same-origin and loopback protections. 2026-08-20 07:02:44 -07:00			`# Copy this file to .env and fill in real values before running.`
			`# docker-compose.yml requires these — it will refuse to start with defaults.`

			`# Neo4j credentials for the graph memory backend (format: user/password).`
fix(security): patch loopback guard, retry None raise, blocking subprocess, and cache stats race - Add `Depends(_require_loopback)` to `/debug/memory` endpoint (was missing while /debug/tasks, /debug/ws-sessions, /debug/warmup all had it) - Guard `raise last_error` when last_error is None (retry_max_attempts=0 path raised TypeError); add ProxyConfig.__post_init__ validation rejecting retry_max_attempts < 1 when retry_enabled=True - Make initialize_context_tool_session_baseline async; offload subprocess via asyncio.to_thread so the blocking rtk/lean-ctx subprocess does not stall the event loop; update call sites in server.py - Take snapshot list() of SemanticCache._cache.values() before iterating in get_memory_stats() to avoid dict-size-changed RuntimeError under async load - Change memory_neo4j_password default from 'password' to '' and emit a logger.warning at startup when backend=qdrant-neo4j and password is empty - Replace hardcoded NEO4J_AUTH=neo4j/password in docker-compose.yml with ${NEO4J_AUTH:-neo4j/devpassword}; add .env.example with CHANGEME placeholder - Format tests/test_provider_proxy_routes.py (pre-existing ruff format drift) 2026-06-02 19:08:45 -04:00			`NEO4J_AUTH=neo4j/CHANGEME`
fix(security): address u9up assessment findings (WEB-01–07) (#2207) Hardens client-selected upstreams, memory identity resolution, downloaded binary integrity, telemetry import, Docker defaults, Neo4j credentials, and archive extraction. Refreshes the branch against current main and preserves newer same-origin and loopback protections. 2026-08-20 07:02:44 -07:00			`# Password only, for library / non-Docker use of the Neo4j memory backend.`
			`NEO4J_PASSWORD=CHANGEME`

			`# Proxy token — gates the data plane whenever the proxy is not loopback-only.`
			`# Generate: openssl rand -hex 32`
			`HEADROOM_PROXY_TOKEN=CHANGEME`

			`# Optional: set to 0.0.0.0 to expose the proxy on the network (requires a token).`
			`# HEADROOM_BIND_ADDR=127.0.0.1`