serverMontime/.env.example

DB_HOST=127.0.0.1
# Local Docker (docker compose up -d): 5432
# Remote DB via SSH tunnel (-L 5433:127.0.0.1:5432): 5433
POSTGRES_PORT=5432
POSTGRES_USER=montime
POSTGRES_PASSWORD=montime
POSTGRES_DB=montime
# Dev only: auto-sync schema from entities (do not use true in production)
DB_SYNC=true

JWT_SECRET=change_me_to_a_long_random_secret
OTP_HASH_SECRET=change_me_to_a_long_random_secret
SUPER_ADMIN_MOBILE=09123456789
# Min seconds between OTP requests for the same mobile
OTP_REQUEST_COOLDOWN_SECONDS=60
# Max OTP requests per mobile per rolling hour
OTP_REQUEST_MAX_PER_HOUR=5
# Dev/test only: returns OTP code in API response instead of sending SMS
AUTH_RETURN_OTP=true

# Local folder for business images (served at /uploads/...)
UPLOAD_DIR=uploads

# Comma-separated frontend origins (required in production for browser clients)
# Include both dev ports if calling API directly (without Vite /api proxy)
CORS_ORIGINS=https://montime.ir,https://adm.montime.ir,http://localhost:5173,http://localhost:5174

# 0098sms.com — used when AUTH_RETURN_OTP is not true
# From panel: account username, password (or web service password), approved sender line (pnlno)
SMS_USERNAME=
SMS_PASSWORD=
# SMS_API_KEY=   # alias for SMS_PASSWORD
SMS_SENDER=
# soap (default, recommended) | link (legacy GET API, often HTTP 500)
SMS_TRANSPORT=soap
# SMS_DOMAIN=0098   # only for link transport
# SMS_TIMEOUT_MS=20000