first commit

Made-with: Cursor

.env.example

@@ -0,0 +1,47 @@
+# =============================================================================
+# Sacred Villas — Stripe & app config
+# Copy to `.env` and fill in. Never commit `.env` (it is gitignored).
+# Dashboard: https://dashboard.stripe.com/apikeys
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# REQUIRED for payments (embedded Checkout)
+# -----------------------------------------------------------------------------
+
+# Secret API key — starts with sk_test_ or sk_live_
+# Server only. Creates Checkout sessions, retrieves sessions, verifies webhooks.
+STRIPE_SECRET_KEY=
+
+# Publishable key — starts with pk_test_ or pk_live_
+# Loaded by Vite into the browser for Embedded Checkout on /apply/checkout.
+# Safe to expose in the frontend bundle; never put the secret key in client code.
+VITE_STRIPE_PUBLISHABLE_KEY=
+
+# Public origin of your app (no trailing slash). Used in Checkout return_url.
+# Local:  http://localhost:5173
+# Live:   https://yourdomain.com
+CLIENT_URL=
+
+# -----------------------------------------------------------------------------
+# RECOMMENDED for production (reliable server-side payment notifications)
+# -----------------------------------------------------------------------------
+
+# Webhook signing secret — starts with whsec_
+# Create endpoint URL: https://yourdomain.com/api/webhooks/stripe
+# Events: at least checkout.session.completed
+# Local testing:  stripe listen --forward-to localhost:4242/api/webhooks/stripe
+STRIPE_WEBHOOK_SECRET=
+
+# -----------------------------------------------------------------------------
+# Optional
+# -----------------------------------------------------------------------------
+
+# PORT=4242
+# NODE_ENV=production
+
+# Random secret for listing/export of housing applications (JSON files under data/applications/).
+# curl -H "Authorization: Bearer YOUR_TOKEN" https://your-host/api/admin/applications
+# APPLICATIONS_ADMIN_TOKEN=
+
+# Override where application JSON files are stored (default: ./data/applications under the app root).
+# APPLICATIONS_DATA_DIR=/var/lib/sacred-villas/applications