From 790002181a65f902a31a9ddae0380e0d6527bd78 Mon Sep 17 00:00:00 2001
From: xfy <i@rua.plus>
Date: Thu, 18 Jun 2026 14:24:09 +0800
Subject: [PATCH] docs(env): add APP_BASE_URL and other security vars to
 .env.example
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Task 1.1 疏漏：只更新了 AGENTS.md，漏了 .env.example。补上本次 review 引入及
原先缺失的 security 变量：
- APP_BASE_URL（CSRF 校验的可信 origin，1.1 引入）
- STATEMENT_TIMEOUT_SECS（慢查询超时，2.4 引入）
- COOKIE_SECURE / TRUSTED_PROXY_COUNT（原先就缺，一并补全）
---
 .env.example | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.env.example b/.env.example
index e8d475d..5100acc 100644
--- a/.env.example
+++ b/.env.example
@@ -11,6 +11,19 @@ RATE_LIMIT_UPLOAD_BURST=15
 RATE_LIMIT_IMAGE_PER_SEC=10
 RATE_LIMIT_IMAGE_BURST=50
 
+# Security
+# Trusted origin for CSRF checks on write requests (POST/PUT/PATCH/DELETE).
+# Set to your production origin, e.g. https://your-domain.example.
+# Unset: falls back to the request Host header + X-Forwarded-Proto (behind a reverse proxy).
+APP_BASE_URL=
+# Set true/1/yes to add the Secure flag to the session cookie (enable in HTTPS production).
+COOKIE_SECURE=false
+# Number of reverse proxies in front of the app; used to extract the real client IP
+# from X-Forwarded-For. 0 when serving directly; 1 behind one proxy (e.g. nginx/Caddy).
+TRUSTED_PROXY_COUNT=0
+# Per-query timeout in seconds; slow queries are canceled to protect the connection pool.
+STATEMENT_TIMEOUT_SECS=30
+
 # WebP encoding configuration
 # Quality: 0.0 (smallest) to 100.0 (best), default 85.0
 WEBP_QUALITY=85.0