Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

.env.example

@@ -0,0 +1,63 @@
+# ---------------------------------------------------------------- basics
+# Only used to name the very first site and to label authenticator app entries.
+# Add further sites, and rename this one, from Admin -> Sites.
+SITE_NAME=Hideaway Visitor Sign In
+TZ=Australia/Melbourne
+PORT=3000
+# Port published on the docker host.
+HOST_PORT=8088
+
+# Long random string. Generate one with:  openssl rand -hex 32
+# Changing this invalidates admin sessions AND makes stored visitor PINs unreadable.
+APP_SECRET=change-me-to-a-long-random-string
+
+# ------------------------------------------------------- admin accounts
+# Used ONCE, to create the first admin account if none exist. After the first
+# sign in you will be asked to set a new password, and further admins are
+# invited from the console.
+ADMIN_BOOTSTRAP_EMAIL=you@example.com
+ADMIN_BOOTSTRAP_PASSWORD=change-me-then-change-again
+
+# Restrict admin sign in to one or more email domains. Blank allows any address.
+# ADMIN_ALLOWED_DOMAINS=hideawaygaming.com.au,school.vic.edu.au
+ADMIN_ALLOWED_DOMAINS=
+
+# Every admin must enrol an authenticator app at first sign in.
+ADMIN_REQUIRE_2FA=true
+
+# --------------------------------------------------------------- kiosk
+# Require a photo before a visitor can complete sign in.
+REQUIRE_PHOTO=true
+# Photos older than this are deleted from disk automatically. 0 disables the sweep.
+PHOTO_RETENTION_DAYS=90
+# Sign out anyone still on site at this local time. Blank turns it off.
+AUTO_SIGNOUT_TIME=18:30
+
+# Warn admins this many days before a recurring visitor's WWCC or VIT expires.
+EXPIRY_WARNING_DAYS=28
+
+# ---------------------------------------------------------------- https
+# The browser will not allow camera access over plain http unless the address is
+# localhost. Either terminate TLS at a reverse proxy, or turn this on and run
+# scripts/gen-cert.sh to create a self-signed certificate.
+HTTPS_ENABLED=false
+HTTPS_KEY=/data/certs/server.key
+HTTPS_CERT=/data/certs/server.crt
+
+# Set both of these to true when running behind an HTTPS reverse proxy.
+TRUST_PROXY=false
+SECURE_COOKIES=false
+
+# --------------------------------------------------------- google sheets
+SHEETS_ENABLED=false
+# The long id from the sheet URL: docs.google.com/spreadsheets/d/<THIS PART>/edit
+SHEETS_SPREADSHEET_ID=
+SHEETS_TAB_NAME=Visitor log
+# Point at the mounted service account json...
+GOOGLE_CREDENTIALS_PATH=/secrets/google-service-account.json
+# ...or paste it base64 encoded instead (base64 -w0 key.json). One or the other.
+GOOGLE_CREDENTIALS_B64=
+SHEETS_RETRY_INTERVAL_MS=60000
+
+# -------------------------------------------------------------- storage
+DATA_DIR=/data