Moheeb Zara
75097a601c
POST /api/cron/notifications drains <=20 pending rows/min, sends via the transport with the row id as Resend Idempotency-Key (overlap-safe), marks sent or increments attempts (retryable -> stay pending, permanent or budget-exhausted -> failed). Constant-time CRON_SECRET bearer check; 503 when unset. ~4.5/s spacing under Resend's 5/s limit. proxy.ts whitelists /api/cron (no session; own shared secret). CRON_SECRET added to .env.example.
62 lines
3.0 KiB
Bash
62 lines
3.0 KiB
Bash
# -----------------------------------------------------------------------------
|
|
# hackerspace-management environment variables
|
|
# -----------------------------------------------------------------------------
|
|
# Copy to .env.local for development; set the same keys on your host for prod.
|
|
# .env.local is git-ignored. Never commit real secrets.
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Supabase (required)
|
|
NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOi...replace-with-anon-key
|
|
|
|
# Server-side admin key. Bypasses RLS. Required for createSpace / joinSpace.
|
|
# Treat as a secret. Never expose to the browser. Never log it.
|
|
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi...replace-with-service-role-key
|
|
|
|
# App URL (required)
|
|
# Public-facing base URL of this deployment. Used in OAuth redirects.
|
|
NEXT_PUBLIC_APP_URL=http://localhost:3000
|
|
|
|
# Secrets vault encryption key (required for the /ops Secrets feature).
|
|
# 32 bytes of cryptographically random data, hex-encoded (64 hex chars).
|
|
# Generate with: openssl rand -hex 32
|
|
# Without this set, the secrets feature falls back to legacy plain-text storage.
|
|
# Rotating this key invalidates all existing ciphertexts; re-enter each secret.
|
|
SECRETS_ENCRYPTION_KEY=
|
|
|
|
# OAuth provider buttons on the login page (optional).
|
|
# Set to "true" only for a provider you have actually configured in Supabase
|
|
# Auth. Unset/anything-else hides that button (an unconfigured provider button
|
|
# just dead-ends in a Supabase error). If neither is "true" the whole
|
|
# "OR / social sign-in" block is hidden.
|
|
NEXT_PUBLIC_OAUTH_GITHUB=
|
|
NEXT_PUBLIC_OAUTH_GOOGLE=
|
|
|
|
# Node env (optional, defaults to "development" locally)
|
|
NODE_ENV=development
|
|
|
|
# Transactional email (optional; required for dues-lifecycle notifications).
|
|
# Resend HTTP API key (https://resend.com, starts with "re_"). Unset = the
|
|
# notification outbox still fills but the dispatcher records each row as
|
|
# failed with "transport not configured" instead of sending.
|
|
RESEND_API_KEY=
|
|
# From address for all platform email. Must be on a domain you have verified
|
|
# in Resend (SPF + DKIM) for production delivery. Friendly name optional.
|
|
# Example: HeatSync Labs <[email protected]>
|
|
EMAIL_FROM=
|
|
# Shared secret guarding the notification dispatcher (/api/cron/notifications).
|
|
# The droplet's crontab POSTs with "Authorization: Bearer $CRON_SECRET" once a
|
|
# minute. Unset = the dispatcher returns 503 and never sends. Generate with:
|
|
# openssl rand -hex 32
|
|
CRON_SECRET=
|
|
|
|
# Docker build flag (only when building the standalone image)
|
|
# Set to "1" in the Dockerfile so next.config.mjs emits standalone output.
|
|
# DOCKER_BUILD=1
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Per-space integration credentials (PayPal, Zeffy, Venmo, Stripe) are stored
|
|
# in the database under the `integrations` table, not in env. The
|
|
# /api/paypal/sync endpoint reads them from there.
|
|
# -----------------------------------------------------------------------------
|