You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
47 lines
2.4 KiB
Bash
47 lines
2.4 KiB
Bash
# SiMS HQ console — environment. Copy to `.env` (gitignored) and fill in.
|
|
# Nothing here is required to BOOT (the app runs with none set), but each unlocks
|
|
# a capability. Never commit the filled-in file.
|
|
#
|
|
# NOTE (current deploy): on the company box the DB connection and owner email are
|
|
# HARDCODED in the app (server.ts `HARDCODED_DATABASE_URL`, seed.ts `OWNER_EMAIL`), so
|
|
# no .env file is used there — see deploy/PATHS-AND-NAMES.md. The vars below still work
|
|
# as OVERRIDES if you do set them (e.g. DATABASE_URL takes precedence when present).
|
|
|
|
# --- Core ---
|
|
# Where the SQLite database lives (created on first boot). On the AWS box use an
|
|
# absolute path on a backed-up volume, e.g. /var/lib/sims-hq/data
|
|
HQ_DATA_DIR=/var/lib/sims-hq/data
|
|
# Port the console listens on (default 5182).
|
|
HQ_PORT=5182
|
|
# First-boot owner login (created once, on an empty DB). Set this to the REAL owner's
|
|
# email so the first employee is them; leave unset and it falls back to owner@sims.local.
|
|
# All other staff are created afterwards in the owner-only Employees page.
|
|
HQ_OWNER_EMAIL=
|
|
|
|
# --- Security (set BEFORE first real login) ---
|
|
# Server-held pepper mixed into every password/PIN hash. Without it, a stolen DB
|
|
# can be brute-forced. Generate once, keep secret, NEVER change after users exist:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
SIMS_PIN_PEPPER=
|
|
# HQ_SECRET_KEY — REMOVED in D32. Credentials (portal/gateway passwords, module secrets,
|
|
# client DB passwords, the Gmail token) are stored in the CLEAR; no encryption key is used.
|
|
# May be reintroduced later. Leaving it set has no effect.
|
|
# HQ_SECRET_KEY=
|
|
|
|
# --- Gmail sending (quotations, reminders) ---
|
|
# From a Google Cloud project (OAuth client, app published to Production). After
|
|
# setting these, run: npx tsx apps/hq/scripts/gmail-connect.ts (one-time consent).
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# --- AWS cost-per-client (HQ-3) ---
|
|
# A read-only IAM user with Cost Explorer access. When both are set, the scheduler
|
|
# pulls monthly cost grouped by the 'client' cost-allocation tag.
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
|
|
# --- Postgres (go-live; D19 delivered — see docs/DEPLOY-HQ.md §7) ---
|
|
# When set, the app runs on Postgres; unset → SQLite at HQ_DATA_DIR. Read by server.ts.
|
|
# The var name is DATABASE_URL (NOT HQ_PG_URL — the app ignores that).
|
|
# DATABASE_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq
|