340911b4d1
- Add JWT auth guard with Bearer token and cookie support - Update .env.example files with PASSWORD_PEPPER documentation - Update seeder to use PASSWORD_PEPPER for password hashing - Update seeder README with hash verification examples - Fix frontend auth and page components - Update backend JWT service and seed migration
51 lines
2.1 KiB
Text
51 lines
2.1 KiB
Text
# =============================================================================
|
|
# GoHorse Backoffice - Environment Variables
|
|
# =============================================================================
|
|
|
|
# Server
|
|
BACKOFFICE_PORT=3001
|
|
BACKOFFICE_HOST=0.0.0.0
|
|
NODE_ENV=development
|
|
|
|
# CORS Origins (comma-separated)
|
|
CORS_ORIGINS=http://localhost:3000,http://localhost:8963
|
|
|
|
# =============================================================================
|
|
# Stripe
|
|
# =============================================================================
|
|
STRIPE_SECRET_KEY=sk_test_your_stripe_secret_key
|
|
STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret
|
|
STRIPE_PUBLISHABLE_KEY=pk_test_your_publishable_key
|
|
|
|
# =============================================================================
|
|
# Database
|
|
# =============================================================================
|
|
DATABASE_URL=postgresql://user:password@localhost:5432/gohorse_backoffice
|
|
|
|
# =============================================================================
|
|
# JWT Authentication (Shared with Backend)
|
|
# =============================================================================
|
|
# The backoffice validates JWT tokens issued by the backend.
|
|
# These values MUST match the backend configuration for auth to work.
|
|
|
|
# MUST match backend/.env JWT_SECRET exactly
|
|
JWT_SECRET=your-super-secret-jwt-key
|
|
|
|
# Token expiration (should match backend for consistency)
|
|
JWT_EXPIRATION=7d
|
|
|
|
# NOTE: PASSWORD_PEPPER is NOT needed here.
|
|
# The backoffice does not handle login - it only validates tokens via Bearer header or cookie.
|
|
|
|
# =============================================================================
|
|
# Cloudflare API (for cache management)
|
|
# =============================================================================
|
|
CLOUDFLARE_API_TOKEN=your-cloudflare-api-token
|
|
CLOUDFLARE_ZONE_ID=your-zone-id
|
|
|
|
# =============================================================================
|
|
# cPanel API (for email management)
|
|
# =============================================================================
|
|
CPANEL_HOST=https://cpanel.yourdomain.com:2083
|
|
CPANEL_USERNAME=your-cpanel-username
|
|
CPANEL_API_TOKEN=your-cpanel-api-token
|