# Matriks Environment Variables

Dokumen ini mendokumentasikan seluruh variabel lingkungan (*environment variables*) yang digunakan di seluruh aplikasi dalam monorepo KeluargaMart.

---

## 1. Backend Go (`apps/backend`)

| Variabel | Tipe | Default / Contoh | Deskripsi |
|---|---|---|---|
| `APP_PORT` | Int | `8080` | Port listen server HTTP Go |
| `APP_ENV` | String | `development` / `production` | Mode runtime aplikasi |
| `APP_BASE_URL` | URL | `http://localhost:8080` | Base URL publik backend |
| `DB_HOST` | String | `localhost` / `postgres` | Host server PostgreSQL |
| `DB_PORT` | Int | `5432` | Port server PostgreSQL |
| `DB_USER` | String | `postgres` | Username database |
| `DB_PASSWORD` | Secret | `postgres` | Password database |
| `DB_NAME` | String | `keluargamart` | Nama database |
| `DB_SSLMODE` | String | `disable` / `require` | Mode SSL database connection |
| `REDIS_HOST` | String | `localhost` / `redis` | Host Redis cache |
| `REDIS_PORT` | Int | `6379` | Port Redis cache |
| `REDIS_PASSWORD` | Secret | `""` | Password Redis |
| `JWT_ACCESS_SECRET` | Secret | `super-secret-key-32-chars-min` | Kunci simetris untuk sign Access Token |
| `JWT_REFRESH_SECRET` | Secret | `super-secret-refresh-key-32-chars` | Kunci simetris untuk sign Refresh Token |
| `STORAGE_DRIVER` | String | `local` / `minio` / `s3` | Driver penyimpanan file media |
| `MINIO_ENDPOINT` | URL | `localhost:9000` | Endpoint S3 / MinIO |
| `MINIO_ACCESS_KEY` | String | `minioadmin` | Access key MinIO |
| `MINIO_SECRET_KEY` | Secret | `minioadmin` | Secret key MinIO |
| `MINIO_BUCKET` | String | `keluargamart` | Bucket penyimpanan |
| `SMTP_HOST` | String | `localhost` | Host SMTP mailer |
| `SMTP_PORT` | Int | `1025` (Mailpit) / `587` | Port SMTP |
| `SMTP_USER` | String | `""` | Username SMTP |
| `SMTP_PASSWORD` | Secret | `""` | Password SMTP |

---

## 2. ERP Admin Portal (`apps/erp`)

| Variabel | Tipe | Default / Contoh | Deskripsi |
|---|---|---|---|
| `VITE_API_URL` | URL | `http://localhost:8080` | URL endpoint backend Go API |
| `VITE_APP_TITLE` | String | `KeluargaMart ERP` | Judul aplikasi di browser tab |
| `VITE_ENABLE_MOCK` | Boolean | `false` | Flag debug untuk offline testing |

---

## 3. POS Cashier Frontend (`apps/pos`)

| Variabel | Tipe | Default / Contoh | Deskripsi |
|---|---|---|---|
| `VITE_API_URL` | URL | `http://localhost:8080` | URL endpoint backend Go API |
| `VITE_REGISTER_ID` | String | `REG-01` | Identifier default mesin kasir |
| `VITE_OUTLET_ID` | UUID | `""` | ID default outlet toko jika di-hardcode |

---

## 4. B2B E-Commerce Storefront (`apps/b2b`)

| Variabel | Tipe | Default / Contoh | Deskripsi |
|---|---|---|---|
| `NUXT_PUBLIC_API_URL` | URL | `http://localhost:8080` | URL endpoint backend Go API untuk client-side fetching |
| `NUXT_PUBLIC_SITE_URL`| URL | `http://localhost:3000` | URL domain storefront B2B publik |
| `API_INTERNAL_URL` | URL | `http://backend:8080` | URL direct backend internal container untuk SSR server-side fetch |

---

## 5. NextReport Service (`apps/nextreport`)

| Variabel | Tipe | Default / Contoh | Deskripsi |
|---|---|---|---|
| `PORT` | Int | `8000` | Port listen FastAPI / Flask server |
| `BACKEND_URL` | URL | `http://backend:8080` | URL backend untuk fetch agregasi data transaksi |
| `INTERNAL_API_KEY` | Secret | `shared-internal-key` | Token rahasia otentikasi internal inter-service |

---

## 6. Reverse Proxy / Gateway (`infra/reverse-proxy`)

| Variabel | Default / Contoh | Deskripsi |
|---|---|---|
| `KM_DOMAIN` | `keluargamart.local` / `app.keluargamart.com` | Base domain untuk router TLS Caddy |
| `BACKEND_HOST` | `backend:8080` | Upstream host backend |
| `ERP_HOST` | `erp:80` | Upstream host ERP container |
| `POS_HOST` | `pos:80` | Upstream host POS container |
| `B2B_HOST` | `b2b:3000` | Upstream host B2B SSR container |

---

## 7. Prinsip Keamanan & Secret Management

1. **Dilarang Commit `.env`**: File `.env` masuk dalam `.gitignore` di root dan seluruh subfolder. Hanya template `.env.example` yang boleh di-commit.
2. **Secret Rotation**: JWT secret dan database credentials harus digenerate acak menggunakan minimal 32 karakter alfanumerik pada environment produksi.
3. **CI/CD Secrets**: Di GitHub Actions, seluruh credential di-inject melalui GitHub Repository Secrets (`GHCR_TOKEN`, `DB_PASSWORD`, dsb.).