8acc27466e
Admins can email a new user a welcome with a one-time link to choose their password, and send a reset link from the users list. The sign-in page gets "Forgot password?". Mail goes out through Resend; the emails show the person's sign-in address. - password_links collection (migration applied): only the SHA-256 of each token is stored; invites last 7 days, resets 1 hour, one use each - /set-password and /forgot-password pages and their /api/auth routes - forgot-password never reveals whether an account exists, throttles repeat mails, and builds links only from APP_URL - env: RESEND_API_KEY, EMAIL_FROM, EMAIL_REPLY_TO, APP_URL (docs/setup/email.md) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
107 lines
4.4 KiB
Text
107 lines
4.4 KiB
Text
# ============================================================
|
|
# MEGA Infrastructure — Deployment env template
|
|
# ============================================================
|
|
# Copy this file to `cooler.env` (which is gitignored) and fill in
|
|
# your real values. `cooler.env` is the file you copy-paste into
|
|
# Coolify / Vercel / PocketBase env config when deploying.
|
|
#
|
|
# Generate N8N_INGEST_SECRET with: openssl rand -hex 32
|
|
# Then mirror the same string into the n8n workflow's
|
|
# Send PDF Callback / Send Image Callback x-ingest-secret header.
|
|
#
|
|
# Before going to production, rotate every CHANGE_ME line below.
|
|
# ============================================================
|
|
|
|
|
|
# ----------------------------------------------------------
|
|
# NEXT.JS DASHBOARD (Vercel / host env)
|
|
# ----------------------------------------------------------
|
|
|
|
APP_URL=https://CHANGE_ME.example.com
|
|
|
|
NEXT_PUBLIC_POCKETBASE_URL=https://CHANGE_ME.example.com
|
|
|
|
NEXT_PUBLIC_DEFAULT_THEME=light
|
|
|
|
# Set to users only after the PocketBase login migration and app deployment.
|
|
AUTH_MODE=pin
|
|
|
|
# 4-digit PIN users enter on the login screen.
|
|
NEXT_PUBLIC_APP_PIN=CHANGE_ME
|
|
|
|
# PocketBase admin auth (server-side only). Use email + password
|
|
# OR a pre-set admin token — not both.
|
|
POCKETBASE_ADMIN_EMAIL=CHANGE_ME@example.com
|
|
POCKETBASE_ADMIN_PASSWORD=CHANGE_ME
|
|
# POCKETBASE_ADMIN_TOKEN=
|
|
|
|
# n8n workflow webhook URL. Use the production /webhook/... variant
|
|
# once the workflow is Published; /webhook-test/... works without
|
|
# publishing for local iteration.
|
|
N8N_PO_INGEST_URL=https://CHANGE_ME.example.com/webhook/purchase-order-upload
|
|
|
|
# Shared secret between Next.js /api/purchase-orders/ingest and the
|
|
# n8n callback. MUST match the value in the n8n workflow's Send
|
|
# Callback x-ingest-secret header (same value, hardcoded — self-hosted
|
|
# Coolify n8n has no $env.* runtime).
|
|
N8N_INGEST_SECRET=CHANGE_ME_generate_with_openssl_rand_hex_32
|
|
|
|
|
|
# ----------------------------------------------------------
|
|
# EMAIL (Resend)
|
|
# ----------------------------------------------------------
|
|
# The dashboard sends a welcome invite when an admin adds a user,
|
|
# and a password reset from the "Forgot password?" link.
|
|
#
|
|
# RESEND_API_KEY is the Resend API key (re_...) — the SAME key as
|
|
# the PocketBase SMTP password. Leave it blank to keep the mail
|
|
# feature off; nothing else breaks.
|
|
RESEND_API_KEY=
|
|
|
|
# The sender on the mail. Must be a domain verified in Resend, or
|
|
# the mail lands in spam. See docs/setup/email.md for moving to
|
|
# megainfra.co.za later.
|
|
EMAIL_FROM=MEGA Dashboard <support@apphub.co.za>
|
|
|
|
# Where replies go. Blank = reply to EMAIL_FROM.
|
|
EMAIL_REPLY_TO=
|
|
|
|
|
|
# ----------------------------------------------------------
|
|
# POCKETBASE (PocketBase host env, not the dashboard)
|
|
# ----------------------------------------------------------
|
|
# PB_ADMIN_EMAIL / PB_ADMIN_PASSWORD are used by the dashboard's
|
|
# server-side pbAdmin() client (must match POCKETBASE_ADMIN_* above).
|
|
# PB_URL is the public-facing PocketBase URL (must match
|
|
# NEXT_PUBLIC_POCKETBASE_URL).
|
|
|
|
PB_URL=https://CHANGE_ME.example.com
|
|
PB_ADMIN_EMAIL=CHANGE_ME@example.com
|
|
PB_ADMIN_PASSWORD=CHANGE_ME
|
|
|
|
|
|
# ----------------------------------------------------------
|
|
# POCKETBASE (Next.js process-batch + n8n cron)
|
|
# ----------------------------------------------------------
|
|
# Used by:
|
|
# - Next.js /api/purchase-orders/process-batch to fetch the batch's
|
|
# file from PB when moving it onto the purchase_orders row.
|
|
# - n8n (hardcoded into the workflow's HTTP nodes — see
|
|
# docs/n8n/purchase-order-ingest-implementation.md).
|
|
#
|
|
# Generate via PocketBase admin > Settings > Admins > "Generate token".
|
|
# Both sides must match (Next.js env + n8n workflow hardcoded value).
|
|
POCKETBASE_ADMIN_TOKEN=CHANGE_ME_generate_via_PocketBase_admin_ui_Generate_token
|
|
# ── Added 2026-09: clock corrections + delivery-note pipeline ──────────
|
|
# Server-side copy of the shared PIN (keep equal to NEXT_PUBLIC_APP_PIN).
|
|
# Without it the On-site "Needs attention" correction returns 503.
|
|
APP_PIN=REPLACE_ME
|
|
# Code required to edit a posted receipt. openssl rand -hex 16
|
|
RECEIPT_CORRECTION_SECRET=REPLACE_ME
|
|
# MEGA VAT number the DN pipeline checks on every slip.
|
|
MEGA_CUSTOMER_VAT_NO=4280307796
|
|
# dn_batches claimed per /api/dn-batches/tick hit.
|
|
DN_TICK_BATCH_SIZE=1
|
|
# Staged vs legacy DN tick runner — exactly "true" once the staged
|
|
# pipeline is rolled out, else "false". See docs/operations.md §8.
|
|
DN_STAGED_INGESTION_ENABLED=false
|