designslife/WebForm-mw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docs: document STAFF_REPORT_KEY env var

Browse Source
This commit is contained in:
Joel Brock
2026-06-05 16:38:38 -07:00
parent 36821f42a8
commit e76ed39091
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DEPLOYMENT.md
+1
View File
@@ -29,6 +29,7 @@ Verify all of the above against your live CiviCRM by hitting `/api/health` (in d
| `CIVI_HTTP_AUTH_PASS` | only if CIVI_HTTP_AUTH_USER is set | HTTP Basic Auth password. |
| `HEALTH_TOKEN` | recommended | Long random string (e.g. `openssl rand -hex 32`). Required to access `/api/health` in production. If unset, that route returns 404. |
| `PUBLIC_ORIGIN` | optional | e.g. `https://survey.fci.coop` — used in absolute self-links if needed later. |
| `STAFF_REPORT_KEY` | recommended | Shared secret guarding the internal staff report at `/staff/report` and the file proxy at `/api/staff/file`. Store alongside the `CIVI_*` secrets. Rotate by changing the env value; all live links must be updated. Anyone with the secret can view any organization's full activity history. |
3. **Trigger the first deploy.** Render will run `npm ci && npm run build` then `npm run start`. The platform health check hits `/healthz` (lightweight, no Civi dependency).