2025-12-18 23:05:04 +05:30
|
|
|
# ===========================================
|
|
|
|
|
# Real Estate Agent Platform - Backend Environment Variables
|
|
|
|
|
# Copy this file to .env and fill in your values
|
|
|
|
|
# ===========================================
|
|
|
|
|
|
|
|
|
|
# Application
|
|
|
|
|
NODE_ENV=development
|
|
|
|
|
PORT=3001
|
|
|
|
|
APP_NAME="Real Estate Agent Platform"
|
|
|
|
|
API_URL=http://localhost:3001
|
|
|
|
|
FRONTEND_URL=http://localhost:3000
|
|
|
|
|
ADMIN_URL=http://localhost:3002
|
|
|
|
|
|
|
|
|
|
# Database (PostgreSQL)
|
|
|
|
|
DATABASE_URL="postgresql://postgres:password@localhost:5432/real_estate_db?schema=public"
|
|
|
|
|
|
|
|
|
|
# JWT Authentication
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# Required. Minimum 32 chars in production; boot fails if shorter.
|
2025-12-18 23:05:04 +05:30
|
|
|
JWT_SECRET=your-super-secret-jwt-key-change-in-production
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# JWT_REFRESH_EXPIRATION MUST be longer than JWT_ACCESS_EXPIRATION.
|
2025-12-18 23:05:04 +05:30
|
|
|
JWT_ACCESS_EXPIRATION=15m
|
|
|
|
|
JWT_REFRESH_EXPIRATION=7d
|
|
|
|
|
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# Two-Factor Authentication
|
|
|
|
|
# Key used to encrypt stored TOTP secrets. Optional — falls back to JWT_SECRET.
|
|
|
|
|
# Set this BEFORE enabling 2FA in a new environment: once secrets are encrypted
|
|
|
|
|
# under JWT_SECRET, rotating JWT_SECRET without re-encrypting locks out every
|
|
|
|
|
# 2FA user. See docs/2fa-key-rotation.md.
|
|
|
|
|
TWO_FACTOR_ENCRYPTION_KEY=
|
|
|
|
|
|
|
|
|
|
# Admin bootstrap (used by `npm run db:seed` only)
|
|
|
|
|
# Required by the seed — there are no defaults. Password must be >= 12 chars.
|
|
|
|
|
ADMIN_EMAIL=admin@example.com
|
|
|
|
|
ADMIN_PASSWORD=change-me-before-seeding
|
|
|
|
|
|
2025-12-18 23:05:04 +05:30
|
|
|
# Password Hashing
|
|
|
|
|
BCRYPT_SALT_ROUNDS=12
|
|
|
|
|
|
|
|
|
|
# Google OAuth
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# NOTE: Google sign-in is handled by NextAuth in the frontend, which posts the
|
|
|
|
|
# verified profile to POST /auth/social. These backend vars are currently NOT
|
|
|
|
|
# consumed by the backend; the authoritative values live in the frontend env.
|
2025-12-18 23:05:04 +05:30
|
|
|
GOOGLE_CLIENT_ID=your-google-client-id
|
|
|
|
|
GOOGLE_CLIENT_SECRET=your-google-client-secret
|
|
|
|
|
GOOGLE_CALLBACK_URL=http://localhost:3001/auth/google/callback
|
|
|
|
|
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# Facebook OAuth — NOT IN USE (Google is the only enabled social provider).
|
|
|
|
|
# Kept only so config/configuration.ts keeps type-checking. Leave blank.
|
|
|
|
|
FACEBOOK_APP_ID=
|
|
|
|
|
FACEBOOK_APP_SECRET=
|
|
|
|
|
FACEBOOK_CALLBACK_URL=
|
2025-12-18 23:05:04 +05:30
|
|
|
|
|
|
|
|
# AWS S3 (File Storage)
|
|
|
|
|
AWS_ACCESS_KEY_ID=your-aws-access-key
|
|
|
|
|
AWS_SECRET_ACCESS_KEY=your-aws-secret-key
|
|
|
|
|
AWS_REGION=us-east-1
|
|
|
|
|
AWS_S3_BUCKET=your-s3-bucket-name
|
2026-01-24 22:19:26 +05:30
|
|
|
S3_FOLDER_PREFIX=development # Root folder for all uploads (e.g., 'development', 'staging', 'production')
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# Custom endpoint for S3-compatible storage (DigitalOcean Spaces, MinIO,
|
|
|
|
|
# Contabo). Leave blank for real AWS S3.
|
2026-08-04 16:12:43 +05:30
|
|
|
# If it ends in /s3 (MinIO behind an nginx path prefix), the SDK signs against
|
|
|
|
|
# the host root and browser-facing URLs keep the /s3 prefix.
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
S3_ENDPOINT=
|
2026-08-04 16:12:43 +05:30
|
|
|
# Public base for browser-facing URLs when it differs from the signing
|
|
|
|
|
# endpoint. Defaults to S3_ENDPOINT.
|
|
|
|
|
S3_PUBLIC_ENDPOINT=
|
2025-12-18 23:05:04 +05:30
|
|
|
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# Email (REQUIRED — boot fails without it)
|
|
|
|
|
# The app POSTs JSON to this endpoint to send all transactional email.
|
|
|
|
|
# There is no SMTP path in the code: MAIL_*/SMTP_* variables are NOT read.
|
|
|
|
|
EMAIL_API_URL=https://your-email-provider.example.com/v1/send
|
2025-12-18 23:05:04 +05:30
|
|
|
|
|
|
|
|
# Stripe (Payments)
|
|
|
|
|
STRIPE_SECRET_KEY=sk_test_your-stripe-secret-key
|
|
|
|
|
STRIPE_WEBHOOK_SECRET=whsec_your-webhook-secret
|
|
|
|
|
STRIPE_PUBLISHABLE_KEY=pk_test_your-stripe-publishable-key
|
|
|
|
|
|
|
|
|
|
# Firebase (Push Notifications)
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# Either point at a service-account JSON file (preferred, path is relative to
|
|
|
|
|
# the process working directory) or supply the three vars below. If neither is
|
|
|
|
|
# present the app still boots and push notifications are silently disabled.
|
|
|
|
|
FIREBASE_SERVICE_ACCOUNT_KEY_PATH=./firebase-service-account.json
|
2025-12-18 23:05:04 +05:30
|
|
|
FIREBASE_PROJECT_ID=your-firebase-project-id
|
|
|
|
|
FIREBASE_CLIENT_EMAIL=firebase-adminsdk@your-project.iam.gserviceaccount.com
|
|
|
|
|
FIREBASE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\nYour-Private-Key\n-----END PRIVATE KEY-----"
|
|
|
|
|
|
|
|
|
|
# Redis (Caching & Queue)
|
|
|
|
|
REDIS_HOST=localhost
|
|
|
|
|
REDIS_PORT=6379
|
|
|
|
|
REDIS_PASSWORD=
|
|
|
|
|
REDIS_DB=0
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# Set to "true" for managed Redis/Valkey over TLS. Certificates are verified —
|
|
|
|
|
# a self-signed cert will be rejected.
|
|
|
|
|
REDIS_TLS=false
|
2025-12-18 23:05:04 +05:30
|
|
|
|
|
|
|
|
# Rate Limiting
|
|
|
|
|
THROTTLE_TTL=60
|
|
|
|
|
THROTTLE_LIMIT=100
|
|
|
|
|
|
|
|
|
|
# Logging
|
|
|
|
|
LOG_LEVEL=debug
|
|
|
|
|
|
|
|
|
|
# CORS
|
fix(security): resolve audit findings — secrets, env contract, migrations
Removes hardcoded fallback secrets and makes a misconfigured deploy fail
loudly instead of silently falling back to development defaults.
- Remove insecure JWT fallback secrets (messages.module, configuration)
- Remove the 'default-secret' fallback for the 2FA TOTP encryption key and
allow a dedicated TWO_FACTOR_ENCRYPTION_KEY so rotating JWT_SECRET no
longer locks out every 2FA user (see docs/2fa-key-rotation.md)
- Require EMAIL_API_URL; drop the hardcoded vendor email endpoint
- Drive WebSocket CORS from CORS_ORIGINS instead of origin:'*'
- Load .env before any Nest module is imported (src/load-env.ts). Decorator
arguments evaluate at import time, so the gateway previously froze its CORS
config to the localhost fallback even when CORS_ORIGINS was set
- Add boot-time env validation: missing required vars, weak JWT_SECRET, and
inverted access/refresh token lifetimes now abort startup
- Enable Redis TLS certificate verification
- Require ADMIN_EMAIL/ADMIN_PASSWORD for the seed; remove the published
default super-admin credentials and stop printing them
- Add the initial Prisma migration and stop gitignoring prisma/migrations
- Make .env.example an accurate configuration contract (admin bootstrap,
REDIS_TLS, S3_ENDPOINT, 2FA key, Firebase path; drop the dead SMTP block)
- Add handover documentation: architecture, ER model, sequence and data-flow
diagrams, 2FA key rotation runbook
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 11:30:36 +05:30
|
|
|
# REQUIRED in production (boot fails without it). Consumed by both the HTTP
|
|
|
|
|
# server and the WebSocket gateway — if unset, real-time messaging only accepts
|
|
|
|
|
# localhost origins and every browser connection from the live domain is
|
|
|
|
|
# rejected.
|
2025-12-18 23:05:04 +05:30
|
|
|
CORS_ORIGINS=http://localhost:3000,http://localhost:3002
|
