# SiMS HQ console — environment. Copy to `.env` (gitignored) and fill in.
# Nothing here is required to BOOT (the app runs with none set), but each unlocks
# a capability. Never commit the filled-in file.
#
# NOTE (current deploy): on the company box the DB connection and owner email are
# HARDCODED in the app (server.ts `HARDCODED_DATABASE_URL`, seed.ts `OWNER_EMAIL`), so
# no .env file is used there — see deploy/PATHS-AND-NAMES.md. The vars below still work
# as OVERRIDES if you do set them (e.g. DATABASE_URL takes precedence when present).

# --- Core ---
# Where the SQLite database lives (created on first boot). On the AWS box use an
# absolute path on a backed-up volume, e.g. /var/lib/sims-hq/data
HQ_DATA_DIR=/var/lib/sims-hq/data
# Port the console listens on (default 5182).
HQ_PORT=5182
# First-boot owner login (created once, on an empty DB). Set this to the REAL owner's
# email so the first employee is them; leave unset and it falls back to owner@sims.local.
# All other staff are created afterwards in the owner-only Employees page.
HQ_OWNER_EMAIL=

# --- Security (set BEFORE first real login) ---
# Server-held pepper mixed into every password/PIN hash. Without it, a stolen DB
# can be brute-forced. Generate once, keep secret, NEVER change after users exist:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SIMS_PIN_PEPPER=
# Encrypts the stored Gmail refresh token (AES-256-GCM). 64 hex chars:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
HQ_SECRET_KEY=

# --- Gmail sending (quotations, reminders) ---
# From a Google Cloud project (OAuth client, app published to Production). After
# setting these, run: npx tsx apps/hq/scripts/gmail-connect.ts  (one-time consent).
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# --- AWS cost-per-client (HQ-3) ---
# A read-only IAM user with Cost Explorer access. When both are set, the scheduler
# pulls monthly cost grouped by the 'client' cost-allocation tag.
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

# --- Postgres (go-live; D19 delivered — see docs/DEPLOY-HQ.md §7) ---
# When set, the app runs on Postgres; unset → SQLite at HQ_DATA_DIR. Read by server.ts.
# The var name is DATABASE_URL (NOT HQ_PG_URL — the app ignores that).
# DATABASE_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq