|
|
# SiMS store-server environment — copy to a real env/secret store for production.
|
|
|
# None of these are required for a dev run (npm start sets SIMS_SEED_DEMO for you), but
|
|
|
# production MUST set the security-critical ones marked below.
|
|
|
|
|
|
# H3 — full-DB encryption at rest (REQUIRED in production).
|
|
|
# When set, the whole SQLite store (sims.db + its WAL/SHM sidecars) is SQLCipher-encrypted on disk,
|
|
|
# so a copied or snooped shop PC yields no customer PII (phones/GSTINs — DPDP), costs & margins,
|
|
|
# sales history, party ledgers or PIN hashes. Held ONLY here / in the OS secret store — NEVER in the
|
|
|
# repo or the DB. On Windows, deliver it via a machine-scoped DPAPI secret (or an OS keychain), not a
|
|
|
# plaintext file next to the DB. Use a long random value, e.g.:
|
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
|
# WARNING: this keys the database. An EXISTING plaintext sims.db must be migrated ONCE offline
|
|
|
# (sqlcipher_export — see openDb() in src/db.ts) before the first encrypted boot; a fresh/empty DB
|
|
|
# is created encrypted automatically. Leave unset only in dev (the file is then plaintext).
|
|
|
SIMS_DB_KEY=
|
|
|
|
|
|
# M3 — server-held PIN/password pepper (REQUIRED in production).
|
|
|
# HMAC-SHA256'd into every PIN/password before scrypt, so a stolen DB cannot be brute-forced
|
|
|
# against the tiny 4-digit PIN keyspace. Keep it out of the DB and out of source control; store
|
|
|
# it in the OS secret store / process env. Use a long random value, e.g.:
|
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
|
# WARNING: enabling or changing this invalidates every existing hash — PINs/passwords must be
|
|
|
# re-enrolled (a dev re-seed handles it automatically). Leave unset only in dev.
|
|
|
SIMS_PIN_PEPPER=
|
|
|
|
|
|
# M10 — demo seed gate. '1' seeds the MegaMart demo (known-credential owner thomas/9174/sims)
|
|
|
# into an empty DB. Leave UNSET in production so a real empty DB is never auto-seeded. The dev
|
|
|
# start script (npm start → dev-start.mjs) sets this to '1' for you.
|
|
|
SIMS_SEED_DEMO=
|
|
|
|
|
|
# M13 — TLS (production should serve HTTPS). Paths to a cert + key; when both are set the server
|
|
|
# serves HTTPS, otherwise plain HTTP for dev. Make a throwaway dev cert with:
|
|
|
# openssl req -x509 -newkey rsa:2048 -nodes -keyout dev-key.pem -out dev-cert.pem -days 365 -subj "/CN=localhost"
|
|
|
SIMS_TLS_CERT=
|
|
|
SIMS_TLS_KEY=
|
|
|
|
|
|
# H1 — extra allowlisted LAN printer ports (comma-separated) beyond the defaults {9100,9101,9102}.
|
|
|
SIMS_PRINTER_PORTS=
|
|
|
|
|
|
# Isolated data dir for a second instance (load tests, throwaway runs). Unset ⇒ ../data.
|
|
|
SIMS_DATA_DIR=
|
|
|
|
|
|
# HTTP port (defaults to 5181; 8080–8085 are Windows-reserved on shop PCs).
|
|
|
PORT=
|