Prepare ERP source for Gitea deployment

2026-06-20 15:01:44 +05:30
commit 5c75eb6bd9
450 changed files with 67698 additions and 0 deletions
@@ -0,0 +1,50 @@
+APP_NAME="Audit Firm v2"
+ENV="dev"
+DEBUG=true
+
+# IMPORTANT: change in production
+SECRET_KEY="change-me-to-a-long-random-string"
+
+# Cookie/security
+COOKIE_SECURE=false
+COOKIE_SAMESITE="lax"         # lax|strict|none
+COOKIE_SESSION_NAME="af2sid"
+
+# DB backend
+DB_BACKEND="sqlite"           # sqlite|postgres
+
+SQLITE_COMMON_PATH="./data/common.db"
+
+ERP_PUBLIC_BASE_URL=http://localhost:8000
+DEV_AUTH_OTP_PRINT=false
+
+# Postgres placeholders (later)
+PG_HOST="127.0.0.1"
+PG_PORT=5432
+PG_USER="postgres"
+PG_PASSWORD="postgres"
+PG_DB_COMMON="audit_common"
+
+# Defaults (context fallback)
+DEFAULT_TENANT_CODE="default"
+DEFAULT_BRANCH_CODE="main"
+DEFAULT_YEAR_CODE="2025-26"
+DEFAULT_TIMEZONE="Asia/Kolkata"
+
+# Security hardening: do not trust browser/client supplied context headers in public deployment.
+# Keep false for production unless an internal proxy/test runner is explicitly trusted.
+TRUST_CONTEXT_HEADERS=false
+TRUST_CONTEXT_HEADER_HOSTS="127.0.0.1,localhost,::1"
+# Optional shared secret for trusted internal callers. If set, caller must send
+# X-AuditFirm-Context-Secret with this value before context headers are accepted.
+CONTEXT_HEADER_SECRET=""
+
+# Bootstrap admin (seeded if users table is empty)
+BOOTSTRAP_ADMIN_EMAIL="admin@auditfirm.local"
+BOOTSTRAP_ADMIN_PASSWORD="ChangeMe@123"
+
+# JWT for API clients (mobile/apps/integrations)
+JWT_ISSUER="audit_firm_v2"
+JWT_AUDIENCE="audit_firm_clients"
+JWT_ACCESS_MINUTES=15
+JWT_REFRESH_DAYS=30