Config: Update production configuration with environment variables

Changes:
- Updated config.py to use environment variables
- Set DEBUG=False as default (production-safe)
- CORS_ORIGINS now configurable via environment
- Added .env.production.example template

Security improvements:
- DEBUG disabled by default (prevents info leaks)
- CORS restricted by default
- All sensitive config via environment variables

Production deployment:
1. Copy .env.production.example to .env
2. Update CORS_ORIGINS with your domain
3. Deploy with DEBUG=False

Closes #44

.env.production.example

@@ -0,0 +1,25 @@
+# VeriFile-X Production Configuration
+# Copy this file to .env in production and update values
+
+# CRITICAL: Set these for production!
+DEBUG=False
+CORS_ORIGINS=https://verifile-x.com,https://www.verifile-x.com
+
+# Rate limiting
+RATE_LIMIT_PER_MINUTE=10
+
+# File limits
+MAX_FILE_SIZE_MB=50
+MAX_ANALYSIS_SIZE_MB=10
+
+# Cache
+CACHE_TTL_MINUTES=60
+MAX_CACHE_SIZE=500
+
+# Logging (use INFO or WARNING in production)
+LOG_LEVEL=INFO
+
+# Server (for Gunicorn/Uvicorn)
+HOST=0.0.0.0
+PORT=8000
+WORKERS=4

backend/core/config.py

@@ -1,40 +1,54 @@
-"""
-Application configuration management.
-Uses environment variables for security-sensitive settings.
-"""
 from pydantic_settings import BaseSettings
-from typing import Optional
-
+from typing import List
+import os
 
 class Settings(BaseSettings):
     """
-    Application settings loaded from environment variables.
+    Application settings with environment variable overrides.
     
-    Why Pydantic? Type validation, auto-documentation, easy testing.
+    Environment variables take precedence over defaults.
+    For production, create a .env file based on .env.example
     """
-    # API Settings
-    API_TITLE: str = "VeriFile-X API"
-    API_VERSION: str = "0.1.0"
-    API_DESCRIPTION: str = "Privacy-preserving digital forensics platform"
     
-    # Server Settings
-    HOST: str = "0.0.0.0"
-    PORT: int = 8000
-    DEBUG: bool = False
+    # CORS Configuration
+    # Development default: localhost only
+    # Production: Set via CORS_ORIGINS environment variable
+    CORS_ORIGINS: str = os.getenv(
+        "CORS_ORIGINS",
+        "http://localhost:3000"  # Development default
+    )
+    
+    @property
+    def cors_origins_list(self) -> List[str]:
+        """Parse CORS_ORIGINS into a list."""
+        return [origin.strip() for origin in self.CORS_ORIGINS.split(",")]
+    
+    # Debug Mode
+    # IMPORTANT: Set DEBUG=False in production!
+    DEBUG: bool = os.getenv("DEBUG", "False").lower() == "true"
+    
+    # API Configuration
+    API_V1_PREFIX: str = "/api/v1"
+    PROJECT_NAME: str = "VeriFile-X"
+    VERSION: str = "6.0.0"
+    
+    # Rate Limiting
+    RATE_LIMIT_PER_MINUTE: int = int(os.getenv("RATE_LIMIT_PER_MINUTE", "10"))
+    
+    # File Upload Limits
+    MAX_FILE_SIZE_MB: int = int(os.getenv("MAX_FILE_SIZE_MB", "50"))
+    MAX_ANALYSIS_SIZE_MB: int = int(os.getenv("MAX_ANALYSIS_SIZE_MB", "10"))
     
-    # File Processing Limits (privacy + performance)
-    MAX_FILE_SIZE_MB: int = 50
-    ALLOWED_IMAGE_TYPES: list = ["image/jpeg", "image/png", "image/webp"]
-    ALLOWED_VIDEO_TYPES: list = ["video/mp4", "video/mpeg"]
-    ALLOWED_DOC_TYPES: list = ["application/pdf"]
+    # Cache Settings
+    CACHE_TTL_MINUTES: int = int(os.getenv("CACHE_TTL_MINUTES", "60"))
+    MAX_CACHE_SIZE: int = int(os.getenv("MAX_CACHE_SIZE", "500"))
     
-    # Security
-    CORS_ORIGINS: list = ["http://localhost:3000"]  # Frontend URLs
+    # Logging
+    LOG_LEVEL: str = os.getenv("LOG_LEVEL", "INFO")
     
     class Config:
         env_file = ".env"
         case_sensitive = True
 
 
-# Singleton pattern - one instance across app
 settings = Settings()

backend/main.py

@@ -33,25 +33,25 @@ async def lifespan(app: FastAPI):
 
 
 app = FastAPI(
-    title=settings.API_TITLE,
-    version=settings.API_VERSION,
-    description=settings.API_DESCRIPTION,
-    lifespan=lifespan,
+    title=settings.PROJECT_NAME,
+    version=settings.VERSION,
+    debug=settings.DEBUG
 )
 
 app.state.limiter = limiter
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 app.add_middleware(SlowAPIMiddleware)
 
-# CORS middleware
+# CORS Configuration
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=settings.CORS_ORIGINS + ["*"],  # Allow frontend
+    allow_origins=settings.cors_origins_list,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
 )
 
+
 # Register API routers
 app.include_router(upload.router)
 app.include_router(analyze.router)