initial commit

apps/cms/.env.example

@@ -0,0 +1,156 @@
+# ---------------------------------------------------------------------------
+# SHARP-ER CMS (Strapi 5) - environment template
+#
+# Copy to .env and fill in real values:   cp .env.example .env
+# Generate every secret/salt/key with:    openssl rand -base64 32
+# Never commit .env, and never copy real secrets back into this file.
+# ---------------------------------------------------------------------------
+
+# Node environment: development | production | test. Drives the CORS defaults
+# in config/middlewares.ts (localhost is only allowed outside production).
+NODE_ENV=development
+
+# --- Server (config/server.ts) ---------------------------------------------
+
+# Address Strapi binds to. 0.0.0.0 listens on every interface.
+HOST=0.0.0.0
+# Port the API and admin panel are served on.
+PORT=1337
+# Public URL of the API, used to build absolute media/admin URLs.
+# Leave commented out in local development; set it behind a proxy or a custom
+# domain, e.g. PUBLIC_URL=https://cms.sharper.ly
+# PUBLIC_URL=
+# true when Strapi sits behind nginx / a load balancer, so X-Forwarded-* headers
+# are trusted for the client IP and protocol.
+IS_PROXIED=false
+# Log verbosity: fatal | error | warn | info | http | debug | trace
+LOG_LEVEL=info
+# Enable the Strapi cron runner (config/server.ts -> cron.enabled).
+CRON_ENABLED=false
+# Include relations in webhook payloads. Off by default: heavier payloads.
+WEBHOOKS_POPULATE_RELATIONS=false
+
+# --- Secrets (config/server.ts, config/admin.ts, config/plugins.ts) ---------
+# All of these are per-environment. Rotating APP_KEYS invalidates sessions;
+# rotating ENCRYPTION_KEY makes already-encrypted values unreadable.
+
+# Comma-separated session signing keys (at least two, so keys can be rotated).
+APP_KEYS="replace-with-random-key-1,replace-with-random-key-2"
+# Salt used to hash API tokens.
+API_TOKEN_SALT=replace-with-random-salt
+# Signing secret for admin-panel sessions.
+ADMIN_JWT_SECRET=replace-with-random-secret
+# Signing secret for Content API (users-permissions) tokens.
+JWT_SECRET=replace-with-random-secret
+# Salt used to hash data-transfer tokens (strapi transfer / import / export).
+TRANSFER_TOKEN_SALT=replace-with-random-salt
+# Key used to encrypt secrets stored in the database (e.g. provider settings).
+ENCRYPTION_KEY=replace-with-random-key
+
+# --- Admin panel (config/admin.ts) -----------------------------------------
+
+# Path (or absolute URL) the admin panel is served from.
+ADMIN_URL=/admin
+# Serve the admin panel from this process. false when it is hosted separately.
+SERVE_ADMIN_PANEL=true
+# Open a browser window on `strapi develop`. Keep false for headless runs.
+ADMIN_AUTO_OPEN=false
+# Admin panel UI flags: NPS survey, EE promotion, documentation links.
+FLAG_NPS=true
+FLAG_PROMOTE_EE=true
+FLAG_DOC_LINKS=true
+
+# --- CORS (config/middlewares.ts) ------------------------------------------
+
+# Comma-separated list of browser origins allowed to call the API.
+# In development http://localhost:5173 and http://127.0.0.1:5173 (the React
+# Router dev server) are always allowed and need not be listed here.
+# Example for production: https://sharper.ly,https://www.sharper.ly
+CORS_ORIGINS=
+
+# --- Database (config/database.ts) -----------------------------------------
+
+# postgres | mysql | sqlite. This project runs on PostgreSQL 16.
+DATABASE_CLIENT=postgres
+# Full connection string. When set it takes precedence over the parts below,
+# so leave it commented out to use DATABASE_HOST/PORT/NAME/USERNAME/PASSWORD.
+# Example: postgres://user:password@host:5432/database
+# DATABASE_URL=
+# Database host.
+DATABASE_HOST=127.0.0.1
+# Database port (5432 for PostgreSQL, 3306 for MySQL).
+DATABASE_PORT=5432
+# Database name.
+DATABASE_NAME=sharper_cms
+# Database user.
+DATABASE_USERNAME=postgres
+# Database password.
+DATABASE_PASSWORD=replace-with-your-database-password
+# PostgreSQL schema Strapi writes its tables into.
+DATABASE_SCHEMA=public
+# Enable TLS for the database connection. Usually true on managed databases.
+DATABASE_SSL=false
+# Optional TLS material, only read when DATABASE_SSL=true.
+# DATABASE_SSL_KEY=
+# DATABASE_SSL_CERT=
+# DATABASE_SSL_CA=
+# DATABASE_SSL_CAPATH=
+# DATABASE_SSL_CIPHER=
+# Set to false only for a self-signed database certificate.
+# DATABASE_SSL_REJECT_UNAUTHORIZED=true
+# Connection pool bounds.
+# DATABASE_POOL_MIN=2
+# DATABASE_POOL_MAX=10
+# Milliseconds to wait for a free connection before failing.
+# DATABASE_CONNECTION_TIMEOUT=60000
+# SQLite file, relative to apps/cms. Only used when DATABASE_CLIENT=sqlite.
+# DATABASE_FILENAME=.tmp/data.db
+
+# --- Authentication rate limit (config/plugins.ts) --------------------------
+
+# Window in milliseconds for the users-permissions auth rate limit.
+AUTH_RATE_LIMIT_INTERVAL=60000
+# Maximum auth requests (login, forgot password, ...) per window per IP.
+AUTH_RATE_LIMIT_MAX=5
+
+# --- Public submission rate limit (src/middlewares/rate-limit.ts) -----------
+
+# The three public POST endpoints (contact-submission, event-registration,
+# application) are capped per client IP. The limiter is in-process, so with
+# several Strapi instances the effective cap is this many PER INSTANCE - put a
+# shared limiter in front of a multi-instance deployment.
+# Window in milliseconds.
+SUBMISSION_RATE_LIMIT_INTERVAL=60000
+# Maximum submissions per window per IP, per endpoint.
+SUBMISSION_RATE_LIMIT_MAX=5
+# Set to false to switch the limiter off (load tests only - never in production).
+# SUBMISSION_RATE_LIMIT_ENABLED=false
+
+# --- Public account flows (src/bootstrap/auth-permissions.ts) ---------------
+
+# This site has no end-user accounts, so every users-permissions auth endpoint
+# is revoked from the Public role on each boot - `register` above all, which
+# Strapi grants by default and which would let anyone create an API account.
+# List here, comma-separated, only the actions that are DELIBERATELY public,
+# e.g. PUBLIC_AUTH_ACTIONS=callback,forgotPassword. Empty means "none", which
+# is the intended state.
+# PUBLIC_AUTH_ACTIONS=
+
+# --- Media / uploads (config/plugins.ts) ------------------------------------
+
+# Maximum size of a single uploaded file, in bytes. Default 50 MB.
+UPLOAD_MAX_FILE_SIZE=52428800
+# Cache-Control max-age (ms) for files served by the local upload provider.
+UPLOAD_LOCAL_MAX_AGE=300000
+
+# Production only - switching the upload provider to S3. Uncomment these after
+# adding @strapi/provider-upload-aws-s3 and editing the upload block in
+# config/plugins.ts (the switch is documented there step by step).
+# AWS_ACCESS_KEY_ID=
+# AWS_ACCESS_SECRET=
+# AWS_REGION=
+# AWS_BUCKET=
+# AWS_ACL=private
+# AWS_SIGNED_URL_EXPIRES=900
+# S3_ROOT_PATH=
+# CDN_URL=