mirror of
https://github.com/Luchexx/wacrm.git
synced 2026-11-02 17:29:45 +00:00
029a20e407
Swaps the Hostinger recommendation on the landing page and throughout the docs from VPS to Managed Node.js Hosting (https://www.hostinger.com/web-apps-hosting). The deploy walkthrough is rewritten around hPanel's Node.js app flow (Git-based deploy, env vars panel, AutoSSL, cron via Advanced → Cron Jobs) instead of a raw Ubuntu VPS with nginx + PM2 + certbot. VPS stays mentioned at the bottom of the deploy page as an alternative when a user actually needs one (background workers, custom binaries, etc.). Also touched: - docs/README.md, environment-variables.md, automations-and-cron.md, troubleshooting.md to drop VPS-specific assumptions. - footer link URL. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
62 lines
3.4 KiB
Markdown
62 lines
3.4 KiB
Markdown
# Environment variables
|
|
|
|
All runtime configuration lives in `.env.local` during development and in
|
|
your host's environment settings in production. `.env.local.example` is a
|
|
minimal template; the table below is the full reference.
|
|
|
|
## Required
|
|
|
|
| Variable | Where to find it | Notes |
|
|
| --------------------------------- | -------------------------------------------------------------------- | --------------------------------------------------------------------- |
|
|
| `NEXT_PUBLIC_SUPABASE_URL` | Supabase → Project Settings → API → **Project URL** | Public. Shipped to the browser. |
|
|
| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Supabase → Project Settings → API → **anon / public** key | Public. Relies on RLS for safety. |
|
|
| `SUPABASE_SERVICE_ROLE_KEY` | Supabase → Project Settings → API → **service_role** key | **Secret.** Bypasses RLS. Used by webhook + admin routes only. |
|
|
| `ENCRYPTION_KEY` | Generate: `node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"` | 64 hex chars (32 bytes, AES-256-CBC). **Rotating breaks existing tokens.** |
|
|
|
|
## Recommended
|
|
|
|
| Variable | Purpose |
|
|
| ---------------------- | ---------------------------------------------------------------------------------------- |
|
|
| `META_APP_SECRET` | Meta → App Settings → Basic → **App Secret**. Enables `X-Hub-Signature-256` verification on incoming webhooks. |
|
|
| `NEXT_PUBLIC_SITE_URL` | Canonical public URL (e.g., `https://crm.example.com`). Used for absolute URLs, sitemap, OG images. |
|
|
|
|
## Optional
|
|
|
|
| Variable | Purpose |
|
|
| --------------------------- | -------------------------------------------------------------------------------------------------------- |
|
|
| `AUTOMATION_CRON_SECRET` | Shared secret that protects `GET /api/automations/cron`. Required if you schedule the automations drain. See [automations-and-cron.md](./automations-and-cron.md). |
|
|
|
|
## Sample `.env.local`
|
|
|
|
```bash
|
|
# Supabase
|
|
NEXT_PUBLIC_SUPABASE_URL=https://abcd1234.supabase.co
|
|
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOi...
|
|
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi...
|
|
|
|
# Encryption — DO NOT change after first deploy
|
|
ENCRYPTION_KEY=3f9c0a7e4d8b2f1a6c5e8d4b9f0a2c6e8d4b9f0a2c6e8d4b9f0a2c6e8d4b9f0a
|
|
|
|
# Public URL + Meta webhook signing
|
|
NEXT_PUBLIC_SITE_URL=https://crm.example.com
|
|
META_APP_SECRET=abcdef0123456789...
|
|
|
|
# Automation cron
|
|
AUTOMATION_CRON_SECRET=generate-a-long-random-string
|
|
```
|
|
|
|
## Security checklist
|
|
|
|
- Never commit `.env.local`. The repo already ignores it.
|
|
- On Hostinger Managed Node.js (and any other host), set env vars via the
|
|
platform's **Environment variables** panel rather than writing them
|
|
into a tracked file on disk.
|
|
- Rotate `SUPABASE_SERVICE_ROLE_KEY` if it leaks — Supabase lets you
|
|
regenerate it under Project Settings → API.
|
|
- Treat `ENCRYPTION_KEY` like a database master key. Losing it means
|
|
connected WhatsApp accounts must reconnect; rotating it means the same.
|
|
|
|
## Next step
|
|
|
|
[Deploy on Hostinger →](./deployment-hostinger.md)
|