mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 17:29:45 +00:00
e46844d527
Per Meta's brand-use guidance for third-party products, the registered
trademark symbol (®) should appear on the FIRST mention of "WhatsApp"
on each user-facing page. Subsequent mentions on the same page are
left plain.
Surfaces touched (one-per-page first mention):
- Landing hero badge ("Built on the official WhatsApp® Business API").
- src/lib/seo/site-config.ts: SITE_TAGLINE and SITE_DESCRIPTION
(rendered into <title> and <meta description> on every page).
- src/app/opengraph-image.tsx: hero text in social-share image.
- Settings, Inbox connection banner, Automations page subtitle.
- README.md tagline.
- All public docs pages (docs/README.md, docs/whatsapp-setup.md,
docs/getting-started.md, docs/supabase-setup.md,
docs/environment-variables.md, docs/deployment-hostinger.md,
docs/automations-and-cron.md, docs/architecture.md,
docs/troubleshooting.md).
Out of scope: SITE_KEYWORDS (the meta-keywords array isn't
user-rendered text — putting ® on every keyword would look broken in
the meta tag).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
64 lines
3.6 KiB
Markdown
64 lines
3.6 KiB
Markdown
# Environment variables
|
|
|
|
All runtime configuration lives in `.env.local` during development and in
|
|
your host's environment settings in production. `.env.local.example` is a
|
|
minimal template; the table below is the full reference.
|
|
|
|
## Required
|
|
|
|
| Variable | Where to find it | Notes |
|
|
| --------------------------------- | -------------------------------------------------------------------- | --------------------------------------------------------------------- |
|
|
| `NEXT_PUBLIC_SUPABASE_URL` | Supabase → Project Settings → API → **Project URL** | Public. Shipped to the browser. |
|
|
| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Supabase → Project Settings → API → **anon / public** key | Public. Relies on RLS for safety. |
|
|
| `SUPABASE_SERVICE_ROLE_KEY` | Supabase → Project Settings → API → **service_role** key | **Secret.** Bypasses RLS. Used by webhook + admin routes only. |
|
|
| `ENCRYPTION_KEY` | Generate: `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"` | 64 hex chars (32 bytes, AES-256-CBC). **Rotating breaks existing tokens.** |
|
|
| `META_APP_SECRET` | Meta → App Settings → Basic → **App Secret** | Verifies the `X-Hub-Signature-256` HMAC on every inbound webhook. **Without it the webhook rejects every request** — a public deploy cannot receive messages until this is set. |
|
|
|
|
## Recommended
|
|
|
|
| Variable | Purpose |
|
|
| ---------------------- | ---------------------------------------------------------------------------------------- |
|
|
| `NEXT_PUBLIC_SITE_URL` | Canonical public URL (e.g., `https://crm.example.com`). Used for absolute URLs, sitemap, OG images. |
|
|
|
|
## Optional
|
|
|
|
| Variable | Purpose |
|
|
| --------------------------- | -------------------------------------------------------------------------------------------------------- |
|
|
| `AUTOMATION_CRON_SECRET` | Shared secret that protects `GET /api/automations/cron`. Required if you schedule the automations drain. See [automations-and-cron.md](./automations-and-cron.md). |
|
|
|
|
## Sample `.env.local`
|
|
|
|
```bash
|
|
# Supabase
|
|
NEXT_PUBLIC_SUPABASE_URL=https://abcd1234.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOi...
|
|
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi...
|
|
|
|
# Meta App Secret — required for webhook signature verification
|
|
META_APP_SECRET=abcdef0123456789...
|
|
|
|
# Encryption — DO NOT change after first deploy
|
|
ENCRYPTION_KEY=3f9c0a7e4d8b2f1a6c5e8d4b9f0a2c6e8d4b9f0a2c6e8d4b9f0a2c6e8d4b9f0a
|
|
|
|
# Public URL
|
|
NEXT_PUBLIC_SITE_URL=https://crm.example.com
|
|
|
|
# Automation cron
|
|
AUTOMATION_CRON_SECRET=generate-a-long-random-string
|
|
```
|
|
|
|
## Security checklist
|
|
|
|
- Never commit `.env.local`. The repo already ignores it.
|
|
- On Hostinger Managed Node.js (and any other host), set env vars via the
|
|
platform's **Environment variables** panel rather than writing them
|
|
into a tracked file on disk.
|
|
- Rotate `SUPABASE_SERVICE_ROLE_KEY` if it leaks — Supabase lets you
|
|
regenerate it under Project Settings → API.
|
|
- Treat `ENCRYPTION_KEY` like a database master key. Losing it means
|
|
connected WhatsApp® accounts must reconnect; rotating it means the same.
|
|
|
|
## Next step
|
|
|
|
[Deploy on Hostinger →](./deployment-hostinger.md)
|