mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 09:19:51 +00:00
bce345ed03
Prep work so the repo is ready to be public. None of this is runtime code; it's the governance a forker expects on day one. - LICENSE: MIT at repo root. README already claimed MIT; this makes GitHub actually recognise it and show the license badge. - .github/SECURITY.md: private disclosure path via GitHub Security Advisories or email. Spells out scope, safe harbour, and what the reporter should expect — so a researcher finds it before they try to file a public issue. - .env.local.example: fleshed out with the three vars it was missing — META_APP_SECRET (required, from PR 1), NEXT_PUBLIC_SITE_URL (recommended), and AUTOMATION_CRON_SECRET (optional). Grouped as Required / Recommended / Optional with a one-line comment per entry. Includes the openssl/node generators for the secrets. - package.json: description, repository, bugs, homepage, keywords, license, author, engines.node >=20. No runtime impact; feeds npm registry metadata, GitHub's repo sidebar, and prevents forkers from silently installing on Node <20 (Next 16's floor). Typecheck clean; npm install run to refresh the lockfile for the package.json metadata additions (no dependency changes). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
45 lines
2.0 KiB
Plaintext
45 lines
2.0 KiB
Plaintext
# ============================================================
|
|
# REQUIRED — the app won't start without these.
|
|
# ============================================================
|
|
|
|
# Supabase (Project Settings → API)
|
|
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
|
|
|
|
# Supabase service-role key. Bypasses RLS; used only by server-side
|
|
# routes (the webhook and automation engine). Keep this secret —
|
|
# never paste it into client code.
|
|
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
|
|
|
|
# WhatsApp token encryption (64 hex chars = 32 bytes, AES-256-GCM).
|
|
# Generate with:
|
|
# node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
|
|
# Rotating this value orphans every token encrypted under the previous
|
|
# key — users have to re-save their WhatsApp settings to reconnect.
|
|
ENCRYPTION_KEY=your-64-char-hex-key-here
|
|
|
|
# Meta App Secret (Meta for Developers → App Settings → Basic).
|
|
# Verifies the HMAC-SHA256 signature on every inbound webhook POST.
|
|
# Required — without it the webhook rejects every request.
|
|
META_APP_SECRET=your-meta-app-secret
|
|
|
|
# ============================================================
|
|
# RECOMMENDED — safe defaults exist but you'll want to set these.
|
|
# ============================================================
|
|
|
|
# Canonical public URL of this deployment (scheme + host, no trailing
|
|
# slash). Used for the sitemap, OG images, and any email the app
|
|
# sends. Defaults to https://wacrm.tech if unset.
|
|
NEXT_PUBLIC_SITE_URL=https://crm.example.com
|
|
|
|
# ============================================================
|
|
# OPTIONAL — only needed if you use the feature.
|
|
# ============================================================
|
|
|
|
# Shared secret protecting GET /api/automations/cron. Required if you
|
|
# use Wait steps in automations (a scheduled pinger drains pending
|
|
# executions). Generate any long random string:
|
|
# openssl rand -hex 32
|
|
# See docs/automations-and-cron.md.
|
|
# AUTOMATION_CRON_SECRET=generate-a-long-random-string
|