LaLeV/wacrm
1
0
Fork 0
mirror of https://github.com/Luchexx/wacrm.git synced 2026-11-02 09:19:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
8309b2a95b
wacrm/docs
History
Arnas Donauskas be7edfd180
fix(webhook): require META_APP_SECRET, fail closed 
The webhook signature verifier used to fall open with a warning log
when META_APP_SECRET was unset — a deliberate soft-rollout choice that
is unsafe for a public template. A forker who forgets the env var
would be running a fully spoofable webhook: anyone knowing the URL
could POST fabricated status updates and drift broadcast counts.

Now:
- `verifyMetaWebhookSignature` returns false when the secret is missing
  and logs at error level, so the route responds 401 to every POST
  until the operator configures it.
- Docs mark META_APP_SECRET as **required**:
  - docs/environment-variables.md lists it under Required, not
    Recommended.
  - docs/whatsapp-setup.md §6 is now "Signature verification (required)".
  - docs/troubleshooting.md updated accordingly.
- .env.local.example lists the var with guidance on where to find it.

Also fixes a pre-existing gitignore bug: `.env*` was swallowing
`.env.local.example`, which meant forkers running
`cp .env.local.example .env.local` from the getting-started guide
hit "no such file". Added a negation for `*.example`.

Upgrade note for existing deploys: set META_APP_SECRET (Meta → App
Settings → Basic → App Secret) before updating, or inbound webhooks
will 401 until it's configured.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 18:54:52 +03:00
..
automations-and-cron.md fix(hostinger): recommend Managed Node.js Hosting, not VPS 2026-04-19 21:02:10 +03:00
deployment-hostinger.md fix(hostinger): recommend Managed Node.js Hosting, not VPS 2026-04-19 21:02:10 +03:00
environment-variables.md fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
getting-started.md docs: end-to-end self-host setup guide 2026-04-19 20:52:08 +03:00
README.md fix(hostinger): recommend Managed Node.js Hosting, not VPS 2026-04-19 21:02:10 +03:00
supabase-setup.md docs: end-to-end self-host setup guide 2026-04-19 20:52:08 +03:00
troubleshooting.md fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00
whatsapp-setup.md fix(webhook): require META_APP_SECRET, fail closed 2026-04-20 18:54:52 +03:00

README.md

WaCRM documentation

WaCRM is a self-hostable WhatsApp CRM built on Next.js and Supabase. These docs walk you from a freshly forked repo to a production deploy.

Reading order

  1. Getting started — fork the repo, install, run locally.
  2. Supabase setup — create the database, run the migrations, grab the keys.
  3. WhatsApp setup — create a Meta app, connect a phone number, wire the webhook.
  4. Environment variables — the full reference.
  5. Deploy on Hostinger — recommended hosting walkthrough (Managed Node.js Hosting).
  6. Automations cron — schedule the pending executions drain so waits and delays fire.
  7. Troubleshooting — the usual suspects.

What you will need before starting

  • A GitHub account (to fork the repo).
  • A Supabase project on any paid or free tier.
  • A Meta for Developers account with a WhatsApp Business app.
  • A WhatsApp phone number that is not already tied to the regular WhatsApp or WhatsApp Business mobile apps.
  • A Hostinger Managed Node.js Hosting plan (or any Node host that runs long-running Node.js 20+ processes).

Stack at a glance

  • Frontend / API — Next.js 16 (App Router), React 19, Tailwind v4.
  • Database + auth + storage — Supabase (Postgres + RLS).
  • WhatsApp transport — Meta Cloud API (official WhatsApp Business API).
  • Encryption — AES-256-CBC for per-user access tokens.
  • Scheduler — cron (or any pinger) that hits GET /api/automations/cron.

Getting help

If something is unclear or broken, open an issue against the source repo: https://github.com/ArnasDon/wacrm/issues.