d3e7374439
Major architectural upgrade preparing Echo OCR for self-hosted SaaS deployment: - Auth: Built-in Auth.js v5 with credentials + Authentik OIDC SSO, JWT sessions, middleware route protection, login/signup/setup pages, registration API - UI: Dashboard layout with collapsible sidebar nav, AppShell wrapper, route groups for (dashboard) and (auth), new pages for events/people/reports - Schema: Auth.js tables (Account, Session, VerificationToken), Organization, OrgMember, Location, CollectionDay, Invitation, SystemConfig, ApiKey models; proper User relations to ResponseCard/ActivityLog/Notification - Permissions: Role hierarchy (owner/admin/editor/reviewer/viewer) with action-based permission map and requirePermission/requireAuth helpers - Onboarding: Multi-step setup wizard for first-user bootstrap (account, org, location) with SystemConfig tracking - Events: CollectionDay model with rrule support for recurring church services - Auto-assign: Event-aware card assignment engine replacing getPreviousSunday() - Migration: seed-migration.ts script for upgrading existing deployments Made-with: Cursor
34 lines
1 KiB
Text
34 lines
1 KiB
Text
# Database (shared PostgreSQL on CT 102)
|
|
DATABASE_URL="postgresql://echos_ocr:YOUR_PASSWORD@192.168.68.102:5432/echos_ocr"
|
|
|
|
# Vercel AI Gateway (routes to OpenAI, Google, Anthropic, etc.)
|
|
AI_GATEWAY_API_KEY=""
|
|
|
|
# Ollama (only needed if using Ollama as the AI provider)
|
|
OLLAMA_BASE_URL="http://192.168.68.108:11434"
|
|
|
|
# MinIO S3 Storage (CT 105)
|
|
MINIO_ENDPOINT="192.168.68.105"
|
|
MINIO_PORT="9000"
|
|
MINIO_ACCESS_KEY="minioadmin"
|
|
MINIO_SECRET_KEY="YOUR_MINIO_SECRET"
|
|
MINIO_BUCKET="echos-ocr"
|
|
|
|
# Folder Watch (optional, mount a host path into the container)
|
|
WATCH_DIR=""
|
|
|
|
# Auth.js (required — generate with: npx auth secret)
|
|
AUTH_SECRET=""
|
|
|
|
# Authentik OIDC SSO (optional — enables "Sign in with SSO" button)
|
|
# Create an OAuth2/OIDC provider in Authentik and set these values.
|
|
AUTHENTIK_ISSUER=""
|
|
AUTHENTIK_CLIENT_ID=""
|
|
AUTHENTIK_CLIENT_SECRET=""
|
|
|
|
# Legacy Authentik forward-auth (deprecated — will be removed)
|
|
AUTHENTIK_URL="https://auth.stillwell.cloud"
|
|
AUTHENTIK_API_TOKEN=""
|
|
|
|
# Environment indicator (set to "staging" for staging deployments)
|
|
NEXT_PUBLIC_ENV=""
|