fbfdc6877d
- internal/backup: weekly (configurable) snapshots via the existing VACUUM INTO + blob-strip path; restart-safe (only backs up if newest is older than the interval), retains BACKUP_KEEP most recent, prunes the rest. Runs in a background goroutine; failures are logged, never fatal. - Config: BACKUP_DIR (./data/backups), BACKUP_INTERVAL (168h; 0 disables), BACKUP_KEEP (8). - Fix: blob-strip now clears attachments.image_data too, not just receipts. - Fix: STORAGE_DIR is the storage ROOT (default ./data) — receipts/ and attachments/ live under it; corrects the doubled-nesting from item 10. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
52 lines
2 KiB
Text
52 lines
2 KiB
Text
# Copy to .env and fill in. .env is gitignored.
|
|
# Local-dev values shown; for production use the https URLs.
|
|
|
|
# OIDC issuer (Authelia)
|
|
ISSUER_URL=https://auth.maisym.com
|
|
|
|
# OIDC client — must match the client registered in Authelia
|
|
OIDC_CLIENT_ID=hsa-tracker
|
|
OIDC_CLIENT_SECRET=<plaintext from secret.sh — the one you saved>
|
|
|
|
# Where Authelia redirects back. Must be registered in the client's redirect_uris.
|
|
# Local dev:
|
|
REDIRECT_URL=http://localhost:8080/callback
|
|
# Production would be: https://hsa.maisym.com/callback
|
|
|
|
# Group that gates access (403 if the user isn't in it)
|
|
REQUIRED_GROUP=hsa-users
|
|
|
|
# Any random string; used to derive the session-cookie encryption key.
|
|
# Generate one with: openssl rand -base64 32
|
|
SESSION_SECRET=
|
|
|
|
# Listen address
|
|
LISTEN_ADDR=:8080
|
|
|
|
# Storage (defaults shown; relative paths are resolved from the app's working dir).
|
|
# For the LXC deployment use absolute paths under /var/lib/hsa.
|
|
# STORAGE_DIR is the storage ROOT — receipt files go under <STORAGE_DIR>/receipts/
|
|
# <year>/ and attachments under <STORAGE_DIR>/attachments/<year>/.
|
|
DB_PATH=./data/hsa.db
|
|
STORAGE_DIR=./data
|
|
|
|
# Max upload size in megabytes (reject larger). Camera photos can be ~10MB.
|
|
MAX_UPLOAD_MB=32
|
|
|
|
# Scheduled metadata-only DB backups (no image blobs). On by default, weekly.
|
|
# BACKUP_INTERVAL accepts a Go duration (e.g. 168h, 24h); set 0 to disable.
|
|
BACKUP_DIR=./data/backups
|
|
BACKUP_INTERVAL=168h
|
|
BACKUP_KEEP=8
|
|
|
|
# People + categories catalog (seeded into the DB on startup).
|
|
CONFIG_PATH=./config.json
|
|
|
|
# Receipt auto-classification (Anthropic). Leave CLAUDE_API_KEY empty to disable.
|
|
# Tests never need this: they use a mock endpoint (or the cheapest model when
|
|
# HSA_CLASSIFY_IT=1 is set explicitly).
|
|
CLAUDE_API_KEY=
|
|
# Cheap model by default — every receipt upload makes one classification call, so
|
|
# keep this cheap unless you specifically need a stronger model. The active model
|
|
# is shown as a footnote on the upload page so you always know what a scan costs.
|
|
CLASSIFY_MODEL=claude-haiku-4-5-20251001
|