You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
41 lines
1.9 KiB
Bash
41 lines
1.9 KiB
Bash
# SiMS HQ console — environment. Copy to `.env` (gitignored) and fill in.
|
|
# Nothing here is required to BOOT (the app runs with none set), but each unlocks
|
|
# a capability. Never commit the filled-in file.
|
|
|
|
# --- Core ---
|
|
# Where the SQLite database lives (created on first boot). On the AWS box use an
|
|
# absolute path on a backed-up volume, e.g. /var/lib/sims-hq/data
|
|
HQ_DATA_DIR=/var/lib/sims-hq/data
|
|
# Port the console listens on (default 5182).
|
|
HQ_PORT=5182
|
|
# First-boot owner login (created once, on an empty DB). Set this to the REAL owner's
|
|
# email so the first employee is them; leave unset and it falls back to owner@sims.local.
|
|
# All other staff are created afterwards in the owner-only Employees page.
|
|
HQ_OWNER_EMAIL=
|
|
|
|
# --- Security (set BEFORE first real login) ---
|
|
# Server-held pepper mixed into every password/PIN hash. Without it, a stolen DB
|
|
# can be brute-forced. Generate once, keep secret, NEVER change after users exist:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
SIMS_PIN_PEPPER=
|
|
# Encrypts the stored Gmail refresh token (AES-256-GCM). 64 hex chars:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
HQ_SECRET_KEY=
|
|
|
|
# --- Gmail sending (quotations, reminders) ---
|
|
# From a Google Cloud project (OAuth client, app published to Production). After
|
|
# setting these, run: npx tsx apps/hq/scripts/gmail-connect.ts (one-time consent).
|
|
GOOGLE_CLIENT_ID=
|
|
GOOGLE_CLIENT_SECRET=
|
|
|
|
# --- AWS cost-per-client (HQ-3) ---
|
|
# A read-only IAM user with Cost Explorer access. When both are set, the scheduler
|
|
# pulls monthly cost grouped by the 'client' cost-allocation tag.
|
|
AWS_ACCESS_KEY_ID=
|
|
AWS_SECRET_ACCESS_KEY=
|
|
|
|
# --- Postgres (go-live; D19 delivered — see docs/DEPLOY-HQ.md §7) ---
|
|
# When set, the app runs on Postgres; unset → SQLite at HQ_DATA_DIR. Read by server.ts.
|
|
# The var name is DATABASE_URL (NOT HQ_PG_URL — the app ignores that).
|
|
# DATABASE_URL=postgres://hq:PASSWORD@your-rds-endpoint:5432/hq
|