# SiMS HQ console — environment. Copy to `.env` (gitignored) and fill in.
# Nothing here is required to BOOT (the app runs with none set), but each unlocks
# a capability. Never commit the filled-in file.

# --- Core ---
# Where the SQLite database lives (created on first boot). On the AWS box use an
# absolute path on a backed-up volume, e.g. /var/lib/sims-hq/data
HQ_DATA_DIR=/var/lib/sims-hq/data
# Port the console listens on (default 5182).
HQ_PORT=5182

# --- Security (set BEFORE first real login) ---
# Server-held pepper mixed into every password/PIN hash. Without it, a stolen DB
# can be brute-forced. Generate once, keep secret, NEVER change after users exist:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
SIMS_PIN_PEPPER=
# Encrypts the stored Gmail refresh token (AES-256-GCM). 64 hex chars:
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
HQ_SECRET_KEY=

# --- Gmail sending (quotations, reminders) ---
# From a Google Cloud project (OAuth client, app published to Production). After
# setting these, run: npx tsx apps/hq/scripts/gmail-connect.ts  (one-time consent).
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# --- AWS cost-per-client (HQ-3) ---
# A read-only IAM user with Cost Explorer access. When both are set, the scheduler
# pulls monthly cost grouped by the 'client' cost-allocation tag.
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

# --- Postgres (go-live; not yet wired — see docs/DEPLOY-HQ.md) ---
# HQ_PG_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq