# ============================================================================
#  PRODUCTION — pos-api.quickhelpr.com (cPanel Node.js app, Passenger)
#  This file is shipped inside pos-api.zip as ".env". Keep it private.
# ============================================================================
NODE_ENV=production
PORT=4000
TRUST_PROXY=true

# The app runs on the same cPanel server as MariaDB
DB_HOST=localhost
DB_PORT=3306
DB_USER=quickhelpr_quickhelpr
DB_PASSWORD=quickhelprpos
DB_NAME=quickhelpr_pos
DB_CONNECTION_LIMIT=10

JWT_ACCESS_SECRET=MxU43orfis-v9qrU0uRUc6a5StgSYcvedXv_nztfa6_cCSOOCbAZVprbaeqAQ6x-
JWT_ACCESS_TTL=15m
REFRESH_TOKEN_TTL_DAYS=30
CUSTOMER_JWT_SECRET=2jCfuEQthnIfo3XKg31_yDjOCANm6o9eYT0b3XxK012L_CXxFFHcfEFAAF4pUqIf
CUSTOMER_TOKEN_TTL=24h
# AES-256-GCM key for stored gateway/POS secrets. Changing it requires scripts/rotate-encryption-key.ts
ENCRYPTION_KEY=ed2d362022e61111b41ceccff70a49d1d931fe49ef977169b98eefb5068fbaf7

# Frontend (QR links, payment return URLs) and API (webhook URLs) public addresses
APP_URL=https://pos.quickhelpr.com
API_URL=https://pos-api.quickhelpr.com
CORS_ORIGINS=https://pos.quickhelpr.com

UPLOAD_DIR=uploads
MAX_UPLOAD_MB=5
# The SPA is hosted separately on pos.quickhelpr.com
SERVE_FRONTEND=false
FRONTEND_DIST=public
COOKIE_SECURE=true

POS_SYNC_INTERVAL_SECONDS=30
CRON_KEY=AT7f4wtgwuCd3WJBXEF6BcYS8eNDcGv-
