MichilisandClaude Opus 5
ae2ea20b7e
Monorepo (pnpm workspaces) with two deployable apps and three pure packages. apps/api (Hono on Node): Zod validated env that fails fast and names the problem, Kysely factories for SQLite and Postgres chosen by DATABASE_URL scheme, portable migrations covering the whole SPEC section 5 schema, Better Auth with the four roles and seeded demo accounts, localized error envelope, /healthz and /readyz, graceful SIGTERM drain. Dialect specific SQL is confined to the two factories. apps/web (Next.js App Router): locale routed shell in es and en with a language switcher, sign in screen, and a runtime /api proxy so the browser only ever sees one origin and cookies stay first party. packages/i18n ships both catalogs complete; es is generated from COPY.md and a test re-derives it from the document on every run so it cannot drift. packages/contracts holds the Zod schemas and the typed client the web app uses. Verified: 43 vitest tests, 14 Playwright tests on mobile and desktop, typecheck and lint clean, migrate and seed from a clean database, sign in through the proxy with CSRF rejection of foreign origins. Not verified here: docker compose. This user has no access to the docker socket. RULES.md is absent from docs/, so packages/rules exports only RULES_VERSION and no tax rule, check digit or deadline was invented. See DECISIONS.md. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
61 lines
2.2 KiB
Bash
61 lines
2.2 KiB
Bash
# apps/api environment. Copy to .env and adjust. Every variable is validated at boot
|
|
# by src/lib/env.ts, which fails fast with the exact problem.
|
|
|
|
# development | test | production
|
|
NODE_ENV=development
|
|
# Port the Hono server listens on. The web app proxies /api here.
|
|
PORT=4000
|
|
# User facing origin. Used for links in emails, push payloads and Telegram messages.
|
|
APP_PUBLIC_URL=http://localhost:3000
|
|
|
|
# server = serves HTTP. worker = runs the job poller and sweeps, serves only /healthz.
|
|
ROLE=server
|
|
# Run the job poller inside the server process. Set false only when a dedicated
|
|
# worker exists, which requires Postgres (SQLite is single writer).
|
|
JOBS_INLINE=true
|
|
JOBS_POLL_INTERVAL_MS=2000
|
|
# A running job whose lock is older than this returns to pending, for crash recovery.
|
|
JOBS_STALE_MINUTES=10
|
|
|
|
# sqlite:./data/app.db, sqlite::memory: or postgres://user:pass@host:5432/db
|
|
# The dialect is chosen from this scheme. Nothing else selects it.
|
|
DATABASE_URL=sqlite:./data/app.db
|
|
|
|
# Signing key for sessions. At least 32 characters. Generate: openssl rand -base64 32
|
|
BETTER_AUTH_SECRET=change-me-to-at-least-32-characters-long
|
|
# Public origin cookies are issued for. Auth routes are proxied, so this is the web origin.
|
|
BETTER_AUTH_URL=http://localhost:3000
|
|
|
|
# local | s3. local needs one shared volume across replicas; s3 is required to scale out.
|
|
STORAGE_DRIVER=local
|
|
STORAGE_LOCAL_PATH=./data/files
|
|
# Only read when STORAGE_DRIVER=s3. Bucket, region and both keys are then required.
|
|
S3_ENDPOINT=
|
|
S3_REGION=
|
|
S3_BUCKET=
|
|
S3_ACCESS_KEY_ID=
|
|
S3_SECRET_ACCESS_KEY=
|
|
# Needed by MinIO and most non AWS S3 implementations.
|
|
S3_FORCE_PATH_STYLE=true
|
|
|
|
# Optional. Without it, scans with no QR go straight to the manual form instead of OCR.
|
|
ANTHROPIC_API_KEY=
|
|
OCR_MODEL=claude-sonnet-4-6
|
|
|
|
# Optional. Web push is hidden in the UI when unset. Generate: npx web-push generate-vapid-keys
|
|
PUSH_VAPID_PUBLIC_KEY=
|
|
PUSH_VAPID_PRIVATE_KEY=
|
|
|
|
# Optional. Without SMTP_HOST, verification codes and emails are logged to stdout.
|
|
SMTP_HOST=
|
|
SMTP_PORT=587
|
|
SMTP_USER=
|
|
SMTP_PASS=
|
|
SMTP_FROM=
|
|
|
|
# Optional. Telegram is hidden as a notification channel when unset.
|
|
TELEGRAM_BOT_TOKEN=
|
|
|
|
# Locale for anonymous requests. Signed in users are served their profiles.locale.
|
|
DEFAULT_LOCALE=es
|