Stefan Lazic
841ee7eb52
Example of vps deploy with infra split from business. Keeps one mysql instance for all.
101 lines
4.8 KiB
Bash
101 lines
4.8 KiB
Bash
# One business's config on the shared multi-business VPS setup — see
|
|
# docker-compose.infra.yaml for the one-time setup this depends on
|
|
# (creating this business's database on the shared MySQL server) and
|
|
# docker-compose.<business>.yaml for how this file is used. Copy this to
|
|
# `.env.business.<slug>` (e.g. `.env.business.blake-heritage` — kept out
|
|
# of git, see .gitignore) per business and fill in real values. Nothing
|
|
# here is a real credential.
|
|
#
|
|
# The app starts and runs a complete first-install flow with ONLY the
|
|
# "Required for basic startup" section below filled in — every other
|
|
# integration (email, push, Google sign-in, Google Calendar) shows a
|
|
# disabled state rather than crashing when its variables are left blank.
|
|
|
|
# ── Required for basic startup ─────────────────────────────────────────
|
|
# The public domain this business is served on — used by Traefik's
|
|
# routing label (see docker-compose.<business>.yaml) to decide which
|
|
# container handles requests for it, so this must be set and must match
|
|
# the domain's real DNS (pointed at the VPS) before Traefik can issue a
|
|
# certificate for it.
|
|
DOMAIN="blake-heritage.example.com"
|
|
|
|
# The app reaches MySQL via the shared infra's service hostname
|
|
# `next-chair-mysql`, never `localhost` — see docker-compose.infra.yaml.
|
|
# DATABASE_NAME/USER/PASSWORD must match exactly what you created for
|
|
# this business on the shared server (see docker-compose.infra.yaml's
|
|
# "CREATE DATABASE ..." step) — this file doesn't create them, it only
|
|
# tells the app what to connect as.
|
|
DATABASE_HOST="next-chair-mysql"
|
|
DATABASE_PORT="3306"
|
|
DATABASE_NAME="blake_heritage"
|
|
DATABASE_USER="blake_heritage"
|
|
DATABASE_PASSWORD="replace-me"
|
|
# Generate with: npx auth secret
|
|
AUTH_SECRET="replace-me-with-a-32-byte-random-string"
|
|
# Auth.js needs to trust the host it's served from when not on localhost:3000.
|
|
AUTH_TRUST_HOST="true"
|
|
NEXT_PUBLIC_APP_URL="https://blake-heritage.example.com"
|
|
# One-time setup token the installation wizard (/install) requires before
|
|
# it will create the first business/administrator — generate with:
|
|
# openssl rand -hex 32
|
|
INSTALLATION_TOKEN="replace-me"
|
|
# Shared secret an external scheduler presents to
|
|
# /api/cron/process-notifications — generate with: openssl rand -hex 32
|
|
CRON_SECRET="replace-me"
|
|
|
|
# ── Super Administrator (optional — see scripts/ensure-super-admin.ts) ──
|
|
# Platform-level account with every Owner permission. Not run
|
|
# automatically by this compose file (that's a Docker-entrypoint-only
|
|
# behaviour, see docker/entrypoint.sh) — run it manually, once, the same
|
|
# way migrations were run for the Vercel/Hostinger deployment earlier:
|
|
# docker exec -it next-chair-blake-heritage npx tsx scripts/ensure-super-admin.ts
|
|
# Leave SUPER_ADMIN_EMAIL blank to skip entirely and use the /install
|
|
# wizard's own administrator account instead.
|
|
SUPER_ADMIN_EMAIL=""
|
|
SUPER_ADMIN_PASSWORD=""
|
|
SUPER_ADMIN_FIRST_NAME=""
|
|
SUPER_ADMIN_LAST_NAME=""
|
|
|
|
# ── Google sign-in (optional — "Continue with Google" on Sign In) ─────
|
|
AUTH_GOOGLE_ID=""
|
|
AUTH_GOOGLE_SECRET=""
|
|
|
|
# ── Google Calendar sync (optional — staff-level, see /staff/settings/calendar) ─
|
|
# From https://console.cloud.google.com/apis/credentials — a separate
|
|
# OAuth client from AUTH_GOOGLE_ID/SECRET above (different scopes).
|
|
GOOGLE_CALENDAR_CLIENT_ID=""
|
|
GOOGLE_CALENDAR_CLIENT_SECRET=""
|
|
GOOGLE_CALENDAR_REDIRECT_URI="https://blake-heritage.example.com/api/staff/calendar/google/callback"
|
|
# Encrypts stored refresh tokens at rest — generate with: openssl rand -hex 32
|
|
CALENDAR_TOKEN_ENCRYPTION_KEY=""
|
|
|
|
# ── Media Manager (optional — see src/lib/media/media-storage.ts) ──────
|
|
# Max upload size in bytes for the Media Manager. Defaults to 5,000,000
|
|
# (5MB) if unset.
|
|
MEDIA_MAX_UPLOAD_BYTES="5000000"
|
|
|
|
# ── Google Reviews (optional — see /owner/settings/reviews) ────────────
|
|
# From https://console.cloud.google.com/apis/credentials — needs "Places
|
|
# API (New)" enabled on that project (a different product from the older
|
|
# "Places API" — enabling the wrong one returns REQUEST_DENIED). Leave
|
|
# blank to keep review sync disabled entirely (Home shows clearly-labelled
|
|
# demo reviews instead).
|
|
GOOGLE_PLACES_API_KEY=""
|
|
|
|
# ── Email (optional — defaults to logging to the console instead of sending) ─
|
|
EMAIL_PROVIDER="console"
|
|
EMAIL_SMTP_HOST="smtp-relay.brevo.com"
|
|
EMAIL_SMTP_PORT="587"
|
|
EMAIL_SMTP_USERNAME=""
|
|
EMAIL_SMTP_PASSWORD=""
|
|
EMAIL_FROM_ADDRESS=""
|
|
EMAIL_FROM_NAME=""
|
|
|
|
# ── Web Push (optional — defaults to logging to the console instead of sending) ─
|
|
# Generate with: npx web-push generate-vapid-keys
|
|
PUSH_PROVIDER="console"
|
|
VAPID_PUBLIC_KEY=""
|
|
NEXT_PUBLIC_VAPID_PUBLIC_KEY=""
|
|
VAPID_PRIVATE_KEY=""
|
|
VAPID_SUBJECT="mailto:owner@example.com"
|