From 3ab7c1334f92403b27089427b79553783f8f0c49 Mon Sep 17 00:00:00 2001
From: Chris <christian@haschek.at>
Date: Mon, 20 Apr 2026 21:47:09 +0200
Subject: [PATCH] feat: add API_KEY and BLOCK_PRIVATE_IPS config vars

---
 docker-compose.yml | 2 ++
 docker/start.sh    | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 853c461..940e72d 100755
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,5 +7,7 @@ services:
       - ./logs:/srv/logs
     environment:
       - URL=http://localhost:8080
+      # - API_KEY=your-secret-key      # if set, all /api requests must provide it
+      # - BLOCK_PRIVATE_IPS=true       # block LAN/loopback/metadata IPs (recommended for public hosting)
     ports:
       - 8080:80
diff --git a/docker/start.sh b/docker/start.sh
index bad971e..dd2fc98 100755
--- a/docker/start.sh
+++ b/docker/start.sh
@@ -17,6 +17,8 @@ _buildConfig() {
     echo "<?php"
     echo "date_default_timezone_set('Europe/Vienna');"
     echo "define('URL','${URL:-http://localhost:8080}');"
+    echo "define('API_KEY','${API_KEY:-}');"
+    echo "define('BLOCK_PRIVATE_IPS',${BLOCK_PRIVATE_IPS:-false});"
     echo ""
 }