mirror of
https://github.com/temetro/temetro.git
synced 2026-08-03 23:47:58 +00:00
Khalid Abdi
99aa534e88
The relay is now multi-clinic. Each clinic authenticates to the /hub namespace by signing a challenge with its own Ed25519 clinic signing key (a per-clinic identity, not a shared RELAY_TOKEN), and the relay routes every device response back to only the clinic that originated the request (keyed by requestId) — so clinics never see each other's traffic. Backend: - clinic_signing_keys.network_enabled + GET/PUT /api/signing/network (owner/admin) to join/leave the network. - relay-client keeps one authenticated hub connection per network-enabled org (connectOrg/disconnectOrg, hubs map keyed by orgId); emitToWallet/ sendToWallet take orgId; offline flush is org-scoped. - Wallet import/push return 409 until a clinic joins. - RELAY_TOKEN is now optional/legacy (open relay needs no shared secret). Frontend: - "Join Temetro Network" toggle in Settings → Signing, localized in all five languages (en, fr, de, so, ar). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
58 lines
2.7 KiB
Bash
58 lines
2.7 KiB
Bash
# --- Database -------------------------------------------------------------
|
|
# When running via docker compose, "db" is the Postgres service hostname.
|
|
# For running the backend directly on your host, use localhost:5432.
|
|
DATABASE_URL=postgres://temetro:temetro@db:5432/temetro
|
|
|
|
# --- Better Auth ----------------------------------------------------------
|
|
# Generate a strong secret (min 32 chars): openssl rand -base64 32
|
|
BETTER_AUTH_SECRET=replace-me-with-openssl-rand-base64-32
|
|
# Public base URL of THIS backend (used for auth callbacks & cookies).
|
|
BETTER_AUTH_URL=http://localhost:4000
|
|
|
|
# Directory for uploaded patient/lab files. Defaults to ./uploads in local dev;
|
|
# in Docker it's a persistent volume (see docker-compose.yml).
|
|
UPLOAD_DIR=./uploads
|
|
|
|
# --- AI ------------------------------------------------------------------
|
|
# Key used to encrypt at-rest AI provider API keys (per-user, set in the app's
|
|
# Settings → AI). Generate one: openssl rand -base64 32. Rotating it forces
|
|
# users to re-enter their provider keys.
|
|
AI_CREDENTIALS_KEY=replace-me-with-openssl-rand-base64-32
|
|
|
|
# --- App ------------------------------------------------------------------
|
|
# The frontend origin — used for CORS, Better Auth trustedOrigins, and the
|
|
# links embedded in verification / reset / invitation emails.
|
|
FRONTEND_URL=http://localhost:3000
|
|
PORT=4000
|
|
NODE_ENV=development
|
|
|
|
# Host ports docker compose publishes. Change any that are already in use on
|
|
# this machine (the services still talk to each other on their internal ports).
|
|
POSTGRES_PORT=5432
|
|
BACKEND_PORT=4000
|
|
FRONTEND_PORT=3000
|
|
|
|
# --- Temetro Network relay ------------------------------------------------
|
|
# The standalone relay (github.com/temetro/temetro-network) that connects this
|
|
# backend to patient phones. Deploy it (e.g. on Railway) and point both this
|
|
# backend and the wallet app at it. RELAY_URL is the relay's public URL (also
|
|
# baked into the QR a patient scans). This clinic authenticates to the relay's
|
|
# /hub with its own Ed25519 signing key, so no shared secret is needed.
|
|
# RELAY_TOKEN is OPTIONAL/LEGACY — set it only for a private relay that also
|
|
# gates on a shared token (then use the SAME value here and on the relay).
|
|
RELAY_URL=http://localhost:8080
|
|
RELAY_TOKEN=
|
|
|
|
# (Legacy, pre-relay self-hosting.) A phone-reachable URL for the QR when NOT
|
|
# using the Temetro Network relay. RELAY_URL takes precedence over this.
|
|
# PUBLIC_RELAY_URL=http://192.168.1.20:4000
|
|
|
|
# --- Email (optional) -----------------------------------------------------
|
|
# If SMTP_HOST is unset, emails (verify/reset/invite) are printed to the
|
|
# server console instead of being sent — zero setup for local development.
|
|
# SMTP_HOST=smtp.example.com
|
|
# SMTP_PORT=587
|
|
# SMTP_USER=
|
|
# SMTP_PASS=
|
|
# SMTP_FROM="temetro <no-reply@temetro.local>"
|