chore: implement Phase 1 and 2 security remediations

backend/config/config.go

@@ -16,9 +16,11 @@ type Config struct {
 	TrashDir       string
 	VersionsDir    string
 	BackupDir      string
-	MaxLoginAttempts int
 	LockoutSeconds   int
 	OnlyOfficeJWT    string
+	OnlyOfficeHost   string
+	PublicURL        string
+	InternalAPIURL   string
 }
 
 func Load() *Config {
@@ -31,6 +33,13 @@ func Load() *Config {
 		MaxLoginAttempts: getEnvInt("MAX_LOGIN_ATTEMPTS", 5),
 		LockoutSeconds:   getEnvInt("LOCKOUT_SECONDS", 300),       // 5 minutes
 		OnlyOfficeJWT:    getEnv("ONLYOFFICE_JWT_SECRET", ""),
+		OnlyOfficeHost:   getEnv("ONLYOFFICE_HOST", "office.elijahkuntz.com"),
+		PublicURL:        getEnv("PUBLIC_URL", ""),
+		InternalAPIURL:   getEnv("INTERNAL_API_URL", "http://192.168.50.81:5827/api"),
+	}
+
+	if cfg.InternalAPIURL == "" && cfg.PublicURL != "" {
+		cfg.InternalAPIURL = cfg.PublicURL
 	}
 
 	cfg.DBPath = cfg.DataDir + "/drive.db"