sirily/nroxy
1
0
Fork 0
Code Issues 5 Pull Requests 2 Actions 2 Packages Projects Releases Wiki Activity

fix: stop logging password reset secrets

Browse Source
This commit is contained in:
sirily
2026-03-11 13:28:18 +03:00
parent f404c36ed1
commit 348f197d99
4 changed files with 55 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/ops/deployment.md
View File

@@ -23,6 +23,8 @@ Deploy on one VPS with Docker Compose.
- Keep secrets in server-side environment files or a secret manager.
- Back up PostgreSQL and object storage separately.
- Prefer Telegram long polling to avoid an extra public webhook surface for the bot.
- In non-production environments, set `EMAIL_PROVIDER=example` only when you explicitly want the built-in debug transport. It logs redacted email previews and must never emit live password-reset tokens.
- Do not rely on implicit email fallbacks. Unsupported providers now fail fast at startup so misconfigured deployments do not silently drop password-reset or billing mail.
## Upgrade strategy
- Build new images.