wip

config.py

@@ -1,13 +1,19 @@
 import os
+import secrets
 
 
 class Config:
     """Base config."""
 
-    SECRET_KEY = os.environ.get("SECRET_KEY", "dev-key-placeholder")
+    SECRET_KEY = os.environ.get('SECRET_KEY') or secrets.token_hex(32)
+    SQLALCHEMY_DATABASE_URI = os.environ.get('DATABASE_URL') or 'sqlite:///instance/app.db'
     SQLALCHEMY_TRACK_MODIFICATIONS = False
     WTF_CSRF_ENABLED = True
-    SESSION_COOKIE_SECURE = False  # Set to True in production with HTTPS
+    WTF_CSRF_SECRET_KEY = os.environ.get('CSRF_SECRET_KEY') or secrets.token_hex(32)
+    SESSION_TYPE = 'filesystem'
+    SESSION_PERMANENT = False
+    PERMANENT_SESSION_LIFETIME = 3600  # 1 hour
+    REMEMBER_COOKIE_DURATION = 2592000  # 30 days
 
 
 class DevelopmentConfig(Config):