config.env.example

# Copy to `config.env` and adjust values as needed.
#
# Docker (postgres container)
# The database superuser is POSTGRES_USER (default pos), not the conventional name "postgres".
# Tools that default to user "postgres" (psql, IDE DB plugins) will log FATAL: role "postgres" does not exist — use POSTGRES_USER / DB_USER from this file.
POSTGRES_DB=pos
POSTGRES_USER=pos
POSTGRES_PASSWORD=pos
POSTGRES_PORT=5433
#
# FastAPI Backend
# When running in Docker: use service name 'db' and internal port 5432
# When running the backend on your host: use 'localhost' and POSTGRES_PORT
DB_HOST=db
DB_PORT=5432
DB_USER=pos
DB_PASSWORD=pos
DB_NAME=pos

# Security
SECRET_KEY=CHANGE_THIS_TO_A_RANDOM_SECRET_KEY_IN_PRODUCTION
# Refresh token secret (must be DIFFERENT from SECRET_KEY for security)
REFRESH_SECRET_KEY=CHANGE_THIS_TO_ANOTHER_RANDOM_SECRET_IN_PRODUCTION
# Token expiration settings
ACCESS_TOKEN_EXPIRE_MINUTES=30
REFRESH_TOKEN_EXPIRE_DAYS=7
# CORS origins (comma-separated list of allowed origins)
# Default * allows any host (e.g. IP or domain); restrict in production if desired.
# Examples: CORS_ORIGINS=https://satisfecho.de | CORS_ORIGINS=http://192.168.1.100,https://app.yourdomain.com
CORS_ORIGINS=*

# Optional — Docker dev landing footer git short hash (front volume has no .git).
# ./run.sh sets this from the repo when unset. If you use plain `docker compose` from the repo root:
#   export COMMIT_HASH=$(git rev-parse --short HEAD)
# COMMIT_HASH=

# Frontend URLs (used by Angular app; injected at container start)
# Production (single host): use relative URLs so registration and API work from any host (IP or domain).
# Development (separate front): use absolute URLs, e.g. API_URL=http://localhost:4202/api
API_URL=/api
WS_URL=

# Stripe (payment processing)
# Note: Stripe keys for *guest order* payments are stored per-tenant in Settings.
# Platform STRIPE_SECRET_KEY / STRIPE_PUBLISHABLE_KEY are optional fallbacks for orders
# and are also used for *SaaS subscription Checkout* when SAAS_PAYWALL_ENABLED=true.
# STRIPE_CURRENCY is used as a fallback if tenant has not configured a currency
STRIPE_CURRENCY=usd
# STRIPE_SECRET_KEY=
# STRIPE_PUBLISHABLE_KEY=

# Google Analytics 4 (gtag measurement ID)
# Prefer storing the real ID in gitignored `.secrets` (see `.secrets.example`) so it is
# never committed. Compose / entrypoints inject GOOGLE_ANALYTICS_MEASUREMENT_ID into
# front/src/index.html at container start. Leave unset to disable tracking.
# GOOGLE_ANALYTICS_MEASUREMENT_ID=G-XXXXXXXXXX

# Platform SaaS paywall (restaurant signup monetization — issue #296)
# Off by default so local/demo keep working. Enable in production when ready.
# Existing tenants are grandfathered; new signups get status "none" until trial/subscribe.
SAAS_PAYWALL_ENABLED=false
SAAS_TRIAL_DAYS=14
SAAS_PLAN_PRICE_CENTS=4900
SAAS_PLAN_CURRENCY=eur
# Optional Stripe Price ID for Checkout; without it, "Start free trial" still works (no card).
# SAAS_STRIPE_PRICE_ID=price_...
# Stripe webhook signing secret for POST /saas/webhook (Dashboard → Developers → Webhooks).
# Required to sync cancel / past_due / renewals without the browser confirm-checkout call.
# SAAS_STRIPE_WEBHOOK_SECRET=whsec_...

# Unpaid public Satisfecho Delivery TTL cleanup (ops — not a compose env flag)
# Cancels abandoned unpaid guest checkouts past a TTL (default 2h). Staff-created delivery orders are never touched.
# Local / Docker:  docker compose exec back python -m app.seeds.cleanup_unpaid_public_delivery
#                  docker compose exec back python -m app.seeds.cleanup_unpaid_public_delivery --dry-run
#                  docker compose exec back python -m app.seeds.cleanup_unpaid_public_delivery --ttl-hours 4
# amvara9 cron:    ./scripts/cleanup-unpaid-public-delivery-on-server.sh
# Docs: docs/0053-satisfecho-delivery-order-channel.md (§ Unpaid public checkout cleanup)
#       docs/0001-ci-cd-amvara9.md (§ Unpaid public Satisfecho Delivery cleanup)

# Revolut Merchant API — for testing/demo tenants only (system-wide fallback when tenant has no key)
# Production tenants must set their own Revolut Merchant API secret in Settings (per-tenant).
# Get the secret from Revolut Business Sandbox → API / Merchant API.
# REVOLUT_MERCHANT_SECRET=sk_...

# Base URL of the public app (for links in emails and Revolut payment redirects).
# When set: reservation emails include view/cancel links; Revolut checkout redirects back to this origin.
# Required for password-reset emails: staff/provider "Forgot password" returns HTTP 503 until this is set
# (and SMTP must be configured globally or per-tenant). Examples: https://satisfecho.de or http://127.0.0.1:4202
# PUBLIC_APP_BASE_URL=https://satisfecho.de
#
# Meta (Facebook Page / Instagram Business) — Settings → Social posts OAuth + publishing.
# Register an app at developers.facebook.com; set OAuth redirect to your API callback, e.g.
# https://your-host/api/tenant/social/oauth/meta/callback when ROOT_PATH=/api (or set META_OAUTH_REDIRECT_URI explicitly).
# Instagram publishing needs PUBLIC_APP_BASE_URL so Graph API can fetch /uploads/{tenant}/social/… image URLs.
# META_APP_ID=
# META_APP_SECRET=
# META_GRAPH_VERSION=v21.0
# META_OAUTH_REDIRECT_URI=
#
# Optional — legal document URLs for the whole deployment (landing, login, register).
# Tenants can override in Settings → Data & privacy (contact section). Use https://…
# If unset but PUBLIC_APP_BASE_URL is set, the API falls back to {PUBLIC_APP_BASE_URL}/terms and /privacy (same SPA).
# PUBLIC_TERMS_OF_SERVICE_URL=https://satisfecho.de/terms
# PUBLIC_PRIVACY_POLICY_URL=https://satisfecho.de/privacy
#
# Password reset emails link to {PUBLIC_APP_BASE_URL}/reset-password?token=… (staff + provider).
# Without PUBLIC_APP_BASE_URL, POST /password-reset/request responds with 503 (password_reset_not_configured).
# Optional: token lifetime (minutes, default 60).
# PASSWORD_RESET_TOKEN_EXPIRE_MINUTES=60
# Optional: max reset-email requests per client IP per hour (default 5; higher in non-production).
# RATE_LIMIT_PASSWORD_RESET_PER_HOUR=5

# Email (SMTP) – used for sending transactional emails (e.g. reservation confirmations)
# For Gmail: use an App Password (not your normal password). See docs/0056-gmail-setup.md
# SMTP_HOST=smtp.gmail.com
# SMTP_PORT=587
# SMTP_USE_TLS=true
# SMTP_USER=your-email@gmail.com
# SMTP_PASSWORD=your-16-char-app-password
# EMAIL_FROM=your-email@gmail.com
# If unset, the backend default is noreply@satisfecho.de (see back/app/settings.py); set explicitly in production.
# EMAIL_FROM_NAME=Your Restaurant Name

# WhatsApp (Twilio) – optional; when set, reservation reminders can be sent via WhatsApp when customer_phone is present
# TWILIO_ACCOUNT_SID=AC...
# TWILIO_AUTH_TOKEN=...
# TWILIO_WHATSAPP_FROM=+14155238886
# Default country code for normalizing phone numbers (ISO 3166-1 alpha-2, e.g. ES, DE, US)
# DEFAULT_PHONE_COUNTRY=ES
#
# Optional — Products bulk import: menu photo → vision API extracts dishes/prices (image not stored).
# When unset, staff can still import from JSON; the menu-photo tab stays disabled.
# PRODUCT_VISION_API_KEY=
# PRODUCT_VISION_API_URL=https://api.openai.com/v1/chat/completions
# PRODUCT_VISION_MODEL=gpt-4o-mini
#
# Rate limit: public guest feedback form submissions per client IP per hour (default 15; higher in non-production)
# RATE_LIMIT_GUEST_FEEDBACK_PER_HOUR=15
# Rate limit: public loyalty club join per client IP per hour (default 20; higher in non-production)
# RATE_LIMIT_LOYALTY_JOIN_PER_HOUR=20

# Club loyalty wallet (optional) — see docs/0066-club-loyalty.md. Never commit real certs/keys.
# Shared platform Pass Type ID / Google issuer for all tenants; per-tenant disable via
# Settings → Loyalty → wallet_passes_enabled. Apple multi-merchant: one Pass Type ID for
# the Satisfecho org; restaurant name is set as organizationName on each pass.
# LOYALTY_APPLE_PASS_TYPE_ID=
# LOYALTY_APPLE_TEAM_ID=
# LOYALTY_APPLE_PASS_CERT_PATH=   # PEM cert for Pass Type ID
# LOYALTY_APPLE_PASS_KEY_PATH=    # PEM private key
# LOYALTY_APPLE_WWDR_CERT_PATH=   # Apple WWDR intermediate PEM
# LOYALTY_APPLE_APNS_KEY_PATH=    # optional .p8 for PassKit push-update (HTTP/2)
# LOYALTY_APPLE_APNS_KEY_ID=
# LOYALTY_APPLE_WEB_SERVICE_BASE_URL=  # optional; default PUBLIC_APP_BASE_URL+ROOT_PATH+/public/passkit
# LOYALTY_GOOGLE_ISSUER_ID=
# LOYALTY_GOOGLE_SERVICE_ACCOUNT_JSON=  # path to service-account JSON (never commit)

# VeriFactu / fiscal middleware (Spain) — docs/0065 + docs/0074 (chosen: Fiskaly SIGN ES)
# FISCAL_MIDDLEWARE_PROVIDER=generic   # fiskaly_sign_es | generic | mock (mock = non-prod only)
# FISCAL_MIDDLEWARE_BASE_URL=          # optional override; SIGN ES defaults to Fiskaly TEST/LIVE hosts
# FISCAL_MIDDLEWARE_API_KEY=
# FISCAL_MIDDLEWARE_API_SECRET=
# FISCAL_FISKALY_CLIENT_ID=            # default SIGN ES client UUID
# Require unlock + provider credentials before tenants can select fiscal_mode=live
FISCAL_LIVE_UNLOCK=false

# German TSE / KassenSichV — docs/0072 + docs/0074 (chosen: Fiskaly SIGN DE); separate from VeriFactu
# TSE_PROVIDER=generic                 # fiskaly_sign_de | generic | mock (mock = non-prod only)
# TSE_PROVIDER_BASE_URL=               # optional override; SIGN DE defaults to Fiskaly hosts
# TSE_PROVIDER_API_KEY=
# TSE_PROVIDER_API_SECRET=
# TSE_FISKALY_TSS_ID=                  # Fiskaly TSS UUID
# Require unlock + provider credentials before tenants can select tse_mode=live
TSE_LIVE_UNLOCK=false

# Platform operator portal (SaaS admin at /platform/login) — run: docker compose exec back python -m app.seeds.ensure_platform_operator
# PLATFORM_OPERATOR_EMAIL=ops@yourcompany.de
# PLATFORM_OPERATOR_PASSWORD=choose-a-strong-password

# Courier portal (manual testing / demo seed tenant 1) — log in at /courier/login.
# Same defaults as front/scripts/test-courier-actions.mjs and app.seeds.seed_demo_courier_user.
# COURIER_EMAIL=courier-test-phase1@amvara.de
# COURIER_PASSWORD=secret

# Marketing sites at /<slug>/ (see config/marketing-sites.json) — optional sync when pos-front starts (Docker dev).
# PAT with **Actions: read** for **every** marketing repo in the manifest (e.g. 010_antillana, 020_dilruba, …).
# A token scoped to only one repo will leave other slugs on the committed placeholder in production.
# MARKETING_ARTIFACT_TOKEN=
# SYNC_MARKETING_ON_START=1
# Set to 1 to re-fetch/re-build on every start (default only replaces placeholder bundles):
# MARKETING_REFRESH_EVERY_START=0
# MARKETING_NG_CONFIGURATION=production