# SiMS store-server environment — copy to a real env/secret store for production.
# None of these are required for a dev run (npm start sets SIMS_SEED_DEMO for you), but
# production MUST set the security-critical ones marked below.

# H3 — full-DB encryption at rest (REQUIRED in production).
# When set, the whole SQLite store (sims.db + its WAL/SHM sidecars) is SQLCipher-encrypted on disk,
# so a copied or snooped shop PC yields no customer PII (phones/GSTINs — DPDP), costs & margins,
# sales history, party ledgers or PIN hashes. Held ONLY here / in the OS secret store — NEVER in the
# repo or the DB. On Windows, deliver it via a machine-scoped DPAPI secret (or an OS keychain), not a
# plaintext file next to the DB. Use a long random value, e.g.:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# WARNING: this keys the database. An EXISTING plaintext sims.db must be migrated ONCE offline
# (sqlcipher_export — see openDb() in src/db.ts) before the first encrypted boot; a fresh/empty DB
# is created encrypted automatically. Leave unset only in dev (the file is then plaintext).
SIMS_DB_KEY=

# M3 — server-held PIN/password pepper (REQUIRED in production).
# HMAC-SHA256'd into every PIN/password before scrypt, so a stolen DB cannot be brute-forced
# against the tiny 4-digit PIN keyspace. Keep it out of the DB and out of source control; store
# it in the OS secret store / process env. Use a long random value, e.g.:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# WARNING: enabling or changing this invalidates every existing hash — PINs/passwords must be
# re-enrolled (a dev re-seed handles it automatically). Leave unset only in dev.
SIMS_PIN_PEPPER=

# M10 — demo seed gate. '1' seeds the MegaMart demo (known-credential owner thomas/9174/sims)
# into an empty DB. Leave UNSET in production so a real empty DB is never auto-seeded. The dev
# start script (npm start → dev-start.mjs) sets this to '1' for you.
SIMS_SEED_DEMO=

# M13 — TLS (production should serve HTTPS). Paths to a cert + key; when both are set the server
# serves HTTPS, otherwise plain HTTP for dev. Make a throwaway dev cert with:
#   openssl req -x509 -newkey rsa:2048 -nodes -keyout dev-key.pem -out dev-cert.pem -days 365 -subj "/CN=localhost"
SIMS_TLS_CERT=
SIMS_TLS_KEY=

# H1 — extra allowlisted LAN printer ports (comma-separated) beyond the defaults {9100,9101,9102}.
SIMS_PRINTER_PORTS=

# Isolated data dir for a second instance (load tests, throwaway runs). Unset ⇒ ../data.
SIMS_DATA_DIR=

# HTTP port (defaults to 5181; 8080–8085 are Windows-reserved on shop PCs).
PORT=