feat: add production deployment for rf4spotter.ru

apps/api/app/config.py

@@ -1,8 +1,9 @@
-from pydantic import Field
+from pydantic import Field, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
 class Settings(BaseSettings):
+    deployment_environment: str = "development"
     database_url: str = "postgresql+psycopg://rf4:rf4_local@localhost:5432/rf4_spotter"
     admin_token: str = "change-me-in-production"
     s3_endpoint_url: str = "http://localhost:9000"
@@ -18,7 +19,27 @@ class Settings(BaseSettings):
     import_interval_seconds: int = Field(default=3600, ge=3600)
     rate_limit_secret: str = "change-rate-limit-secret"
     log_level: str = "INFO"
+    cors_origins: list[str] = Field(default_factory=lambda: ["http://localhost:4321", "http://127.0.0.1:4321"])
     model_config = SettingsConfigDict(env_file=".env", extra="ignore")
 
+    @model_validator(mode="after")
+    def reject_insecure_production_defaults(self) -> "Settings":
+        if self.deployment_environment != "production":
+            return self
+        insecure = {
+            "ADMIN_TOKEN": self.admin_token == "change-me-in-production" or len(self.admin_token) < 32,
+            "RATE_LIMIT_SECRET": self.rate_limit_secret == "change-rate-limit-secret" or len(self.rate_limit_secret) < 32,
+            "S3_ACCESS_KEY": self.s3_access_key == "rf4-local" or len(self.s3_access_key) < 12,
+            "S3_SECRET_KEY": self.s3_secret_key == "rf4-local-secret" or len(self.s3_secret_key) < 32,
+        }
+        invalid = [name for name, failed in insecure.items() if failed]
+        if invalid:
+            raise ValueError(f"insecure production settings: {', '.join(invalid)}")
+        if not self.cors_origins or any(not origin.startswith("https://") for origin in self.cors_origins):
+            raise ValueError("production CORS_ORIGINS must contain only HTTPS origins")
+        if not self.s3_public_endpoint_url.startswith("https://"):
+            raise ValueError("production S3_PUBLIC_ENDPOINT_URL must use HTTPS")
+        return self
+
 
 settings = Settings()

apps/api/app/main.py

@@ -34,7 +34,7 @@ logger = logging.getLogger("rf4.api")
 app = FastAPI(title="RF4 Spotter API", version="0.1.0")
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["http://localhost:4321", "http://127.0.0.1:4321"],
+    allow_origins=settings.cors_origins,
     allow_methods=["GET", "POST", "PATCH", "DELETE"],
     allow_headers=["Authorization", "Content-Type"],
 )
@@ -50,6 +50,11 @@ async def structured_request_log(request: Request, call_next):
         response = await call_next(request)
         status_code = response.status_code
         response.headers["X-Request-ID"] = request_id
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+        if settings.deployment_environment == "production":
+            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
         return response
     except Exception as exc:
         logger.error("request failed", extra={"request_id": request_id, "error_type": type(exc).__name__})