Reklamator/config/production.py

"""Production configuration"""
import os

class ProductionConfig:
    """Production environment configuration"""
    DEBUG = False
    TESTING = False

    # Security
    SECRET_KEY = os.environ.get('SECRET_KEY')  # Required in production
    if not SECRET_KEY:
        raise ValueError("SECRET_KEY environment variable must be set in production")

    # Paths
    DATA_DIR = os.environ.get('DATA_DIR', '/var/lib/reklamator/data')

    # Flask-WTF CSRF
    WTF_CSRF_ENABLED = True
    WTF_CSRF_TIME_LIMIT = None

    # File Upload
    MAX_CONTENT_LENGTH = int(os.environ.get('MAX_CONTENT_LENGTH', 10 * 1024 * 1024))  # 10MB

    # AI Integration
    ANTHROPIC_API_KEY = os.environ.get('ANTHROPIC_API_KEY')  # Required
    if not ANTHROPIC_API_KEY:
        raise ValueError("ANTHROPIC_API_KEY environment variable must be set in production")

    # ClamAV
    CLAMD_SOCKET = os.environ.get('CLAMD_SOCKET', '/var/run/clamav/clamd.ctl')

    # Rate Limiting
    RATELIMIT_ENABLED = os.environ.get('RATE_LIMIT_ENABLED', 'true').lower() == 'true'
    RATELIMIT_STORAGE_URL = 'memory://'
    RATELIMIT_PER_HOUR = int(os.environ.get('RATE_LIMIT_PER_HOUR', 10))

    # Session - HTTPS only
    SESSION_COOKIE_SECURE = True  # HTTPS only
    SESSION_COOKIE_HTTPONLY = True
    SESSION_COOKIE_SAMESITE = 'Lax'
    PERMANENT_SESSION_LIFETIME = 86400  # 24 hours

    # Security Headers (T196 - HSTS for HTTPS enforcement)
    SEND_FILE_MAX_AGE_DEFAULT = 31536000  # 1 year for static files
    STRICT_TRANSPORT_SECURITY = 'max-age=31536000; includeSubDomains'  # HSTS: 1 year
    X_CONTENT_TYPE_OPTIONS = 'nosniff'
    X_FRAME_OPTIONS = 'DENY'
    X_XSS_PROTECTION = '1; mode=block'