Reverse warning for ARKINDEX_API_TOKEN
The system checks currently show a warning if ponos.default_env.ARKINDEX_API_TOKEN
is not set. This was necessary back when we still had internal users, as we had to pass an API token to all workers. We've had Ponos task authentication for a while now, where ARKINDEX_TASK_TOKEN
is set automatically. We don't need hardcoded API tokens in the settings anymore; we should avoid them.
Please reverse the behavior of the system checks: when ARKINDEX_API_TOKEN
is set, show a new warning, with a different number, explaining that sharing an API token with all tasks is a security issue. The dev setup no longer needs its default of deadbeefTestToken
either. Please update the system checks wiki page to document this new warning, and update the previous warning.
The warnings for ARKINDEX_API_URL
and ARKINDEX_API_CSRF_COOKIE
should be left unchanged, as those are still important.