julian
c2f06a5d2a
Add @fastify/websocket. EventLog fires an onAppended callback after each durable append; device-events gains a ledger channel (emitLedger). /api/ws fans out ledger + occupancy + printer-status to authenticated booth clients. Origin allowlist (WS_ALLOWED_ORIGINS) replaces CSRF for the handshake (anti-CSWSH). Note: server.ts also reflects later booth route wiring; the final HEAD builds.
32 lines
1.4 KiB
Bash
32 lines
1.4 KiB
Bash
# Copy this file to `.env` (same folder: apps/server/.env) and fill it in.
|
|
# The dev/start scripts load it automatically via Node's --env-file-if-exists.
|
|
#
|
|
# cp apps/server/.env.example apps/server/.env
|
|
#
|
|
# Required ----------------------------------------------------------------
|
|
# The server refuses to start without a strong JWT_SECRET (>=32 chars).
|
|
# Generate one with: openssl rand -hex 32
|
|
JWT_SECRET=
|
|
|
|
# Dedicated HMAC key for signing the append-only event ledger (>=16 chars).
|
|
# Generate with: openssl rand -hex 32
|
|
# If unset, the server falls back to JWT_SECRET (logged as a warning) — fine for
|
|
# dev, but set a dedicated key before production. Events store the key that signed
|
|
# them (keyId), so verifyChain still validates a chain that spans a key change.
|
|
EVENT_SIGNING_KEY=
|
|
|
|
# Optional ----------------------------------------------------------------
|
|
# PORT=3000
|
|
# HOST=0.0.0.0 # interface to bind. 127.0.0.1 = loopback only.
|
|
# LOG_LEVEL=info
|
|
# DATABASE_URL=./parking.sqlite
|
|
# NODE_ENV=production # set in prod: makes auth cookies Secure (HTTPS-only)
|
|
|
|
# First admin (seed once): pnpm --filter @parking/server seed-admin
|
|
# ADMIN_USER=admin
|
|
# ADMIN_PASS=
|
|
|
|
# Comma-separated extra origins allowed to open the booth WebSocket (/api/ws).
|
|
# In dev, set the Vite SPA origin. Same-origin is always allowed without this.
|
|
WS_ALLOWED_ORIGINS=http://localhost:5173
|