joshuaandClaude Sonnet 5
54b89d4f4b
Six site improvements picked from a "what could be better" review, plus a Jest test suite covering the two areas with the trickiest money-handling history in this project (early-bird pricing tranches, donation-leg accounting): - "Add to calendar" .ics download on event pages and in confirmation emails - sitemap.xml, robots.txt, and Open Graph/Twitter metadata for public pages - Sentry error monitoring (backend + frontend), a no-op until SENTRY_DSN is set - Nightly local pg_dump backups with a Site Settings tab to browse/trigger/download - Admin audit trail for refunds, donations, manual registrations, event and settings changes, and staff-initiated cancellations - Jest tests reproducing and guarding against the 1.8.0 tranche-pricing bug and the 1.4.2 donation-balance-inflation bug Wallet passes (Google/Apple) were scoped out of this round — Apple Wallet needs a paid Apple Developer account the project doesn't have yet, and the user preferred shipping both together later rather than Google alone now. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
68 lines
4.6 KiB
Bash
68 lines
4.6 KiB
Bash
# ─── Database ────────────────────────────────────────────────────────────────
|
|
DATABASE_URL="postgresql://username:password@localhost:5432/hope_events"
|
|
|
|
# ─── Auth ─────────────────────────────────────────────────────────────────────
|
|
JWT_SECRET=your_jwt_secret_here_minimum_32_characters
|
|
|
|
# ─── Server ───────────────────────────────────────────────────────────────────
|
|
PORT=5000
|
|
NODE_ENV=development
|
|
|
|
# Set this if the app runs behind a reverse proxy (e.g. nginx on a separate
|
|
# server) so rate limiting reads the real client IP instead of the proxy's.
|
|
# Accepts a hop count ("1"), "true"/"false", or comma-separated IP(s)/CIDR(s)
|
|
# of your trusted proxy (e.g. "10.0.0.5" or "10.0.0.0/8"). Leave unset if the
|
|
# app is not behind a proxy.
|
|
# TRUST_PROXY=1
|
|
|
|
# ─── CORS ─────────────────────────────────────────────────────────────────────
|
|
# Comma-separated list of allowed frontend origins
|
|
FRONTEND_URL=http://localhost:3000
|
|
|
|
# ─── Email (SMTP) — optional fallbacks ───────────────────────────────────────
|
|
# Preferred: configure SMTP via Admin → Site Settings (stored AES-256 encrypted).
|
|
# These env vars are used as fallbacks if no SMTP settings are saved in the DB.
|
|
# EMAIL_HOST=smtp.example.com
|
|
# EMAIL_PORT=587
|
|
# EMAIL_USER=your_email@example.com
|
|
# EMAIL_PASS=your_email_password
|
|
# EMAIL_FROM=no-reply@example.com
|
|
|
|
# ─── Payments (Yoco) ──────────────────────────────────────────────────────────
|
|
YOCO_SECRET_KEY=your_yoco_secret_key
|
|
YOCO_WEBHOOK_SECRET=your_yoco_webhook_secret
|
|
|
|
# ─── Public URLs ──────────────────────────────────────────────────────────────
|
|
# Used to build links in emails (password reset, activation, etc.)
|
|
APP_BASE_URL=https://your-frontend-domain.com
|
|
# Used to serve ticket PDFs to WhatsApp (must be publicly reachable)
|
|
BACKEND_URL=https://your-backend-domain.com
|
|
|
|
# ─── WhatsApp (WAWP) — optional, preferred stored via Admin → Site Settings ───
|
|
# These are env-var fallbacks. Use the admin panel to manage them at runtime.
|
|
WAWP_ACCESS_TOKEN=your_wawp_access_token
|
|
WAWP_INSTANCE_ID=your_wawp_instance_id
|
|
|
|
# ─── Background workers ───────────────────────────────────────────────────────
|
|
DAILY_SUMMARY_ENABLED=true
|
|
SCHEDULED_EMAILS_ENABLED=true
|
|
SCHEDULED_EMAILS_INTERVAL_MS=30000
|
|
# Nightly database backup at 02:00 (requires the `pg_dump` binary on this host).
|
|
# Retention count is set via Admin → Site Settings → Backups (default 14).
|
|
BACKUP_ENABLED=true
|
|
|
|
# ─── Error monitoring (Sentry) — optional ─────────────────────────────────────
|
|
# Leave unset to disable entirely (a no-op, not an error). Set NEXT_PUBLIC_SENTRY_DSN
|
|
# in frontend/.env too if you want frontend errors captured.
|
|
# SENTRY_DSN=https://xxxxx@oxxxxxx.ingest.sentry.io/xxxxx
|
|
|
|
# ─── Note ─────────────────────────────────────────────────────────────────────
|
|
# The following are managed via Admin → Site Settings and stored in the database:
|
|
# - Organisation name, tagline, contact details, branding colour, logo
|
|
# - Registration notification emails
|
|
# - SMTP settings (username and password stored AES-256-GCM encrypted, key
|
|
# derived from JWT_SECRET — do not change JWT_SECRET after saving SMTP creds)
|
|
# - Legal page content (operator name, Information Officer, website URL, etc.)
|
|
# The first-time setup wizard handles initial configuration on fresh deployments.
|
|
# You no longer need ORG_NAME, ORG_TAGLINE, EMAIL_HEADER_COLOR, REGISTRATIONS_EMAIL,
|
|
# or SMTP vars in this file (they still work as fallbacks if the DB entry is absent). |