Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

.env.example

@@ -0,0 +1,88 @@
+# ---------------------------------------------------------------- basics
+# Only used to name the very first site and to label authenticator app entries.
+# Add further sites, and rename this one, from Admin -> Sites.
+SITE_NAME=Hideaway Visitor Sign In
+TZ=Australia/Melbourne
+PORT=3000
+
+# Long random string. Generate one with:  openssl rand -hex 32
+# Changing this invalidates admin sessions AND makes stored visitor PINs unreadable.
+APP_SECRET=change-me-to-a-long-random-string
+
+# ------------------------------------------------------- admin accounts
+# Used ONCE, to create the first admin account if none exist. After the first
+# sign in you will be asked to set a new password, and further admins are
+# invited from the console.
+ADMIN_BOOTSTRAP_EMAIL=you@example.com
+ADMIN_BOOTSTRAP_PASSWORD=change-me-then-change-again
+
+# Restrict admin sign in to one or more email domains. Blank allows any address.
+# ADMIN_ALLOWED_DOMAINS=hideawaygaming.com.au,school.vic.edu.au
+ADMIN_ALLOWED_DOMAINS=
+
+# Every admin must enrol an authenticator app at first sign in.
+ADMIN_REQUIRE_2FA=true
+
+# --------------------------------------------------------------- kiosk
+# Require a photo before a visitor can complete sign in.
+REQUIRE_PHOTO=true
+# Photos older than this are deleted from disk automatically. 0 disables the sweep.
+PHOTO_RETENTION_DAYS=90
+# Sign out anyone still on site at this local time. Blank turns it off.
+AUTO_SIGNOUT_TIME=18:30
+
+# Warn admins this many days before a recurring visitor's WWCC or VIT expires.
+EXPIRY_WARNING_DAYS=28
+
+# ---------------------------------------------------------------- https
+# Browsers block the camera on plain http unless the address is localhost, so the
+# kiosk needs https. Leave this on and the container creates its own certificate
+# authority and server certificate at first start, then renews the server
+# certificate on its own before it lapses.
+HTTPS_ENABLED=true
+SECURE_COOKIES=true
+
+# Every name and address staff might type. These go into the certificate, so a
+# missing one means a browser warning. Re-issues automatically when this changes.
+HTTPS_HOSTNAMES=visitors.local,192.168.1.50
+
+# Ports published on the docker host.
+HOST_PORT=8443
+HOST_HTTP_PORT=8080
+# Must match HOST_PORT: used to build the http -> https redirect.
+HTTPS_PUBLIC_PORT=8443
+# The in-container http helper. 0 turns it off.
+HTTP_REDIRECT_PORT=3001
+
+# Where the certificates live. Leave these alone unless you are supplying your own.
+HTTPS_KEY=/data/certs/server.key
+HTTPS_CERT=/data/certs/server.crt
+
+# Set TRUST_PROXY=true instead if you terminate TLS at a reverse proxy and turn
+# HTTPS_ENABLED off.
+TRUST_PROXY=false
+
+# --------------------------------------------------------- google sheets
+SHEETS_ENABLED=false
+# The long id from the sheet URL: docs.google.com/spreadsheets/d/<THIS PART>/edit
+SHEETS_SPREADSHEET_ID=
+# Append-only history of every sign in and sign out.
+# Rewritten on every change: only the people currently on site. Open this one
+# during an evacuation. Both tabs are created automatically if missing.
+SHEETS_ONSITE_TAB=On site now
+# Point at the mounted service account json...
+GOOGLE_CREDENTIALS_PATH=/secrets/google-service-account.json
+# ...or paste it base64 encoded instead (base64 -w0 key.json). One or the other.
+GOOGLE_CREDENTIALS_B64=
+SHEETS_RETRY_INTERVAL_MS=60000
+
+# ------------------------------------------------------------- printing
+# Badges are rendered and printed by the server, so kiosk tablets need no driver.
+# The printer's address is set per site in Admin -> Sites, not here.
+# PRINT_COMMAND=brother_ql
+PRINT_TIMEOUT_MS=15000
+# How long a sign in waits for the badge before falling back to the kiosk browser.
+PRINT_SIGNIN_WAIT_MS=9000
+
+# -------------------------------------------------------------- storage
+DATA_DIR=/data