mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00

Arnas Donauskas 029a20e407

fix(hostinger): recommend Managed Node.js Hosting, not VPS

Swaps the Hostinger recommendation on the landing page and throughout the
docs from VPS to Managed Node.js Hosting
(https://www.hostinger.com/web-apps-hosting).

The deploy walkthrough is rewritten around hPanel's Node.js app flow
(Git-based deploy, env vars panel, AutoSSL, cron via Advanced → Cron Jobs)
instead of a raw Ubuntu VPS with nginx + PM2 + certbot. VPS stays
mentioned at the bottom of the deploy page as an alternative when a
user actually needs one (background workers, custom binaries, etc.).

Also touched:
  - docs/README.md, environment-variables.md, automations-and-cron.md,
    troubleshooting.md to drop VPS-specific assumptions.
  - footer link URL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-19 21:02:10 +03:00

3.4 KiB

Raw Blame History

Environment variables

All runtime configuration lives in .env.local during development and in your host's environment settings in production. .env.local.example is a minimal template; the table below is the full reference.

Required

Variable	Where to find it	Notes
`NEXT_PUBLIC_SUPABASE_URL`	Supabase → Project Settings → API → Project URL	Public. Shipped to the browser.
`NEXT_PUBLIC_SUPABASE_ANON_KEY`	Supabase → Project Settings → API → anon / public key	Public. Relies on RLS for safety.
`SUPABASE_SERVICE_ROLE_KEY`	Supabase → Project Settings → API → service_role key	Secret. Bypasses RLS. Used by webhook + admin routes only.
`ENCRYPTION_KEY`	Generate: `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`	64 hex chars (32 bytes, AES-256-CBC). Rotating breaks existing tokens.

Variable	Purpose
`META_APP_SECRET`	Meta → App Settings → Basic → App Secret. Enables `X-Hub-Signature-256` verification on incoming webhooks.
`NEXT_PUBLIC_SITE_URL`	Canonical public URL (e.g., `https://crm.example.com`). Used for absolute URLs, sitemap, OG images.

Optional

Variable	Purpose
`AUTOMATION_CRON_SECRET`	Shared secret that protects `GET /api/automations/cron`. Required if you schedule the automations drain. See automations-and-cron.md.

Sample `.env.local`

# Supabase
NEXT_PUBLIC_SUPABASE_URL=https://abcd1234.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOi...
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi...

# Encryption — DO NOT change after first deploy
ENCRYPTION_KEY=3f9c0a7e4d8b2f1a6c5e8d4b9f0a2c6e8d4b9f0a2c6e8d4b9f0a2c6e8d4b9f0a

# Public URL + Meta webhook signing
NEXT_PUBLIC_SITE_URL=https://crm.example.com
META_APP_SECRET=abcdef0123456789...

# Automation cron
AUTOMATION_CRON_SECRET=generate-a-long-random-string

Security checklist

Never commit .env.local. The repo already ignores it.
On Hostinger Managed Node.js (and any other host), set env vars via the platform's Environment variables panel rather than writing them into a tracked file on disk.
Rotate SUPABASE_SERVICE_ROLE_KEY if it leaks — Supabase lets you regenerate it under Project Settings → API.
Treat ENCRYPTION_KEY like a database master key. Losing it means connected WhatsApp accounts must reconnect; rotating it means the same.

Next step

Deploy on Hostinger →

3.4 KiB Raw Blame History