bbeandCursor
70e3e0633d
Introduce granular role-based permissions with SuperAdmin env override, admin roles UI, and permission-gated API routes. Fix admin user Nostr metadata by batching relay profile fetches, normalizing npub pubkeys to hex, and adding reusable NostrAvatar/useNostrProfile components. Co-authored-by: Cursor <cursoragent@cursor.com>
51 lines
2.3 KiB
Bash
51 lines
2.3 KiB
Bash
# SuperAdmin pubkeys (comma-separated hex or npub). SuperAdmins always have every
|
|
# permission, are env-only, and can never be edited or removed through the UI.
|
|
# SUPERADMIN_PUBKEYS replaces the older ADMIN_PUBKEYS. If SUPERADMIN_PUBKEYS is
|
|
# unset, the app falls back to ADMIN_PUBKEYS so existing deployments keep working.
|
|
SUPERADMIN_PUBKEYS=npub1examplepubkey1,npub1examplepubkey2
|
|
|
|
# Nostr relays (comma-separated)
|
|
RELAYS=wss://relay.damus.io,wss://nos.lol,wss://relay.nostr.band
|
|
|
|
# Database (path is relative to the backend working directory for file: URLs — keep deploy cwd consistent)
|
|
# After pulling code: from backend run `npm run migrate:deploy` (or `npm run db:migrate`) so migrations
|
|
# run in order. Do not rely on `db:push` for upgrades that add required columns to non-empty tables.
|
|
#
|
|
# If migrate fails with P3005 (schema not empty / no migration history, e.g. DB was created with db push),
|
|
# from backend run once: `npm run db:baseline-and-migrate` (see scripts/baseline-and-migrate.sh).
|
|
DATABASE_URL="file:./dev.db"
|
|
|
|
# JWT
|
|
JWT_SECRET=change-me-to-a-random-secret-in-production
|
|
|
|
# Backend
|
|
BACKEND_PORT=4000
|
|
FRONTEND_URL=http://localhost:3000
|
|
|
|
# Media storage (path relative to repo root, or use an absolute path in production)
|
|
MEDIA_STORAGE_PATH=storage/media
|
|
|
|
# Frontend (public)
|
|
NEXT_PUBLIC_API_URL=http://localhost:4000/api
|
|
NEXT_PUBLIC_SITE_URL=https://belgianbitcoinembassy.org
|
|
NEXT_PUBLIC_SITE_TITLE=Belgian Bitcoin Embassy
|
|
NEXT_PUBLIC_SITE_TAGLINE=Belgium's Monthly Bitcoin Meetup
|
|
|
|
# Plausible analytics (optional; both must be set or the script is omitted)
|
|
# Tracked site domain (data-domain). Example: belgianbitcoinembassy.org
|
|
NEXT_PUBLIC_PLAUSIBLE_DOMAIN=belgianbitcoinembassy.org
|
|
# Plausible / custom analytics host origin, no trailing slash. Example: https://analytics.azzamo.net
|
|
NEXT_PUBLIC_PLAUSIBLE_ANALYTICS_ORIGIN=https://analytics.azzamo.net
|
|
|
|
# Message board (Lightning / LNbits) — backend
|
|
MESSAGE_PRICE_SATS=1000
|
|
LNBITS_API_KEY=
|
|
LNBITS_WEBHOOK_SECRET=
|
|
LNBITS_URL=https://legend.lnbits.com
|
|
# Public URL that LNbits can POST webhooks to (usually your site origin so /api/messages/webhook hits the API)
|
|
WEBHOOK_BASE_URL=http://localhost:3000
|
|
# Optional: lnaddress or LNURL-pay string for “Zap BBE” when the message has no pubkey
|
|
BOARD_ZAP_LN_ADDRESS=
|
|
# Optional: hex pubkey for njump fallback when BOARD_ZAP_LN_ADDRESS is unset
|
|
BOARD_ZAP_PUBKEY=
|