VPS

Example of vps deploy with infra split from business.

Keeps one mysql instance for all.

.env.business.example

@@ -0,0 +1,100 @@
+# One business's config on the shared multi-business VPS setup — see
+# docker-compose.infra.yaml for the one-time setup this depends on
+# (creating this business's database on the shared MySQL server) and
+# docker-compose.<business>.yaml for how this file is used. Copy this to
+# `.env.business.<slug>` (e.g. `.env.business.blake-heritage` — kept out
+# of git, see .gitignore) per business and fill in real values. Nothing
+# here is a real credential.
+#
+# The app starts and runs a complete first-install flow with ONLY the
+# "Required for basic startup" section below filled in — every other
+# integration (email, push, Google sign-in, Google Calendar) shows a
+# disabled state rather than crashing when its variables are left blank.
+
+# ── Required for basic startup ─────────────────────────────────────────
+# The public domain this business is served on — used by Traefik's
+# routing label (see docker-compose.<business>.yaml) to decide which
+# container handles requests for it, so this must be set and must match
+# the domain's real DNS (pointed at the VPS) before Traefik can issue a
+# certificate for it.
+DOMAIN="blake-heritage.example.com"
+
+# The app reaches MySQL via the shared infra's service hostname
+# `next-chair-mysql`, never `localhost` — see docker-compose.infra.yaml.
+# DATABASE_NAME/USER/PASSWORD must match exactly what you created for
+# this business on the shared server (see docker-compose.infra.yaml's
+# "CREATE DATABASE ..." step) — this file doesn't create them, it only
+# tells the app what to connect as.
+DATABASE_HOST="next-chair-mysql"
+DATABASE_PORT="3306"
+DATABASE_NAME="blake_heritage"
+DATABASE_USER="blake_heritage"
+DATABASE_PASSWORD="replace-me"
+# Generate with: npx auth secret
+AUTH_SECRET="replace-me-with-a-32-byte-random-string"
+# Auth.js needs to trust the host it's served from when not on localhost:3000.
+AUTH_TRUST_HOST="true"
+NEXT_PUBLIC_APP_URL="https://blake-heritage.example.com"
+# One-time setup token the installation wizard (/install) requires before
+# it will create the first business/administrator — generate with:
+# openssl rand -hex 32
+INSTALLATION_TOKEN="replace-me"
+# Shared secret an external scheduler presents to
+# /api/cron/process-notifications — generate with: openssl rand -hex 32
+CRON_SECRET="replace-me"
+
+# ── Super Administrator (optional — see scripts/ensure-super-admin.ts) ──
+# Platform-level account with every Owner permission. Not run
+# automatically by this compose file (that's a Docker-entrypoint-only
+# behaviour, see docker/entrypoint.sh) — run it manually, once, the same
+# way migrations were run for the Vercel/Hostinger deployment earlier:
+#   docker exec -it next-chair-blake-heritage npx tsx scripts/ensure-super-admin.ts
+# Leave SUPER_ADMIN_EMAIL blank to skip entirely and use the /install
+# wizard's own administrator account instead.
+SUPER_ADMIN_EMAIL=""
+SUPER_ADMIN_PASSWORD=""
+SUPER_ADMIN_FIRST_NAME=""
+SUPER_ADMIN_LAST_NAME=""
+
+# ── Google sign-in (optional — "Continue with Google" on Sign In) ─────
+AUTH_GOOGLE_ID=""
+AUTH_GOOGLE_SECRET=""
+
+# ── Google Calendar sync (optional — staff-level, see /staff/settings/calendar) ─
+# From https://console.cloud.google.com/apis/credentials — a separate
+# OAuth client from AUTH_GOOGLE_ID/SECRET above (different scopes).
+GOOGLE_CALENDAR_CLIENT_ID=""
+GOOGLE_CALENDAR_CLIENT_SECRET=""
+GOOGLE_CALENDAR_REDIRECT_URI="https://blake-heritage.example.com/api/staff/calendar/google/callback"
+# Encrypts stored refresh tokens at rest — generate with: openssl rand -hex 32
+CALENDAR_TOKEN_ENCRYPTION_KEY=""
+
+# ── Media Manager (optional — see src/lib/media/media-storage.ts) ──────
+# Max upload size in bytes for the Media Manager. Defaults to 5,000,000
+# (5MB) if unset.
+MEDIA_MAX_UPLOAD_BYTES="5000000"
+
+# ── Google Reviews (optional — see /owner/settings/reviews) ────────────
+# From https://console.cloud.google.com/apis/credentials — needs "Places
+# API (New)" enabled on that project (a different product from the older
+# "Places API" — enabling the wrong one returns REQUEST_DENIED). Leave
+# blank to keep review sync disabled entirely (Home shows clearly-labelled
+# demo reviews instead).
+GOOGLE_PLACES_API_KEY=""
+
+# ── Email (optional — defaults to logging to the console instead of sending) ─
+EMAIL_PROVIDER="console"
+EMAIL_SMTP_HOST="smtp-relay.brevo.com"
+EMAIL_SMTP_PORT="587"
+EMAIL_SMTP_USERNAME=""
+EMAIL_SMTP_PASSWORD=""
+EMAIL_FROM_ADDRESS=""
+EMAIL_FROM_NAME=""
+
+# ── Web Push (optional — defaults to logging to the console instead of sending) ─
+# Generate with: npx web-push generate-vapid-keys
+PUSH_PROVIDER="console"
+VAPID_PUBLIC_KEY=""
+NEXT_PUBLIC_VAPID_PUBLIC_KEY=""
+VAPID_PRIVATE_KEY=""
+VAPID_SUBJECT="mailto:owner@example.com"