mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 13:01:00 +00:00
Marc-André Bombeck
dd1071158f
Connect mints the state nonce into the WhoopOAuthState ledger and redirects to the WHOOP authorize page; callback verifies the nonce (atomic delete-first consume, four distinguished reason tags), exchanges the code, fetches the WHOOP profile for the user id, persists the encrypted WhoopConnection, and enqueues the self-converging history backfill. The webhook handler rate-limits per source first, verifies the WHOOP_WEBHOOK_SECRET path segment, then verifies the HMAC-SHA256 body signature over the raw bytes (timestamp + body, timingSafeEqual, stale timestamp reject) before any work. Valid *.updated enqueues the matching per-resource sync; *.deleted soft-deletes (workouts hard-delete, no soft-delete column). Unknown users return 200 to stop retries. CSP gates api.prod.whoop.com to the WHOOP settings surface + /api/whoop/*; the webhook path joins the public-path allowlist and the path-secret redact registry. Env wiring adds WHOOP_WEBHOOK_SECRET + WHOOP_REDIRECT_URI to the compose whitelist and .env.production.example.
107 lines
4.8 KiB
Bash
107 lines
4.8 KiB
Bash
# =============================================================================
|
|
# HealthLog -- production .env example
|
|
# =============================================================================
|
|
# Mirrors `scripts/env-manifest.json`. The `pnpm check-env --file
|
|
# .env.production.example` CI step (see `.github/workflows/env-check.yml`)
|
|
# enforces every variable declared `required: true` in the manifest has a
|
|
# non-empty placeholder here, so a contributor who introduces a new
|
|
# required var without updating this file fails the workflow.
|
|
#
|
|
# Placeholders are syntactic only -- replace with real secrets before
|
|
# deploying. The check-env presence rule treats any non-empty,
|
|
# non-whitespace string as "set", so the `<placeholder>` style below
|
|
# satisfies the manifest without leaking a usable credential.
|
|
#
|
|
# Generate the two crypto secrets locally with:
|
|
# $ openssl rand -hex 32
|
|
# =============================================================================
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Core -- required for boot
|
|
# -----------------------------------------------------------------------------
|
|
DATABASE_URL="postgresql://healthlog:<password>@db:5432/healthlog?schema=public"
|
|
POSTGRES_PASSWORD="<openssl rand -base64 24>"
|
|
NEXT_PUBLIC_APP_URL="https://healthlog.example.com"
|
|
APP_URL="https://healthlog.example.com"
|
|
ENCRYPTION_KEY="<openssl rand -hex 32>"
|
|
API_TOKEN_HMAC_KEY="<openssl rand -hex 32>"
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Withings OAuth -- optional integration
|
|
# -----------------------------------------------------------------------------
|
|
# WITHINGS_CLIENT_ID=""
|
|
# WITHINGS_CLIENT_SECRET=""
|
|
# WITHINGS_WEBHOOK_SECRET=""
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# WHOOP -- optional integration
|
|
# -----------------------------------------------------------------------------
|
|
# The WHOOP app client id/secret are per-user BYO-keys: each user registers
|
|
# their own WHOOP developer app and pastes the client id/secret into Settings
|
|
# (stored encrypted in the DB). There is therefore no WHOOP_CLIENT_ID/SECRET.
|
|
#
|
|
# WHOOP_WEBHOOK_SECRET is the instance-level secret carried as the trailing
|
|
# path segment of the webhook URL AND used to verify the WHOOP HMAC body
|
|
# signature. WHOOP_REDIRECT_URI overrides the derived
|
|
# `${NEXT_PUBLIC_APP_URL}/api/whoop/callback` when the public URL differs.
|
|
# WHOOP_WEBHOOK_SECRET="<openssl rand -hex 32>"
|
|
# WHOOP_REDIRECT_URI=""
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APNs -- iOS push (optional, all-or-none)
|
|
# -----------------------------------------------------------------------------
|
|
# APNS_KEY_ID=""
|
|
# APNS_TEAM_ID=""
|
|
# APNS_BUNDLE_ID=""
|
|
# APNS_KEY="" # OR APNS_KEY_FILE -- either one satisfies the manifest
|
|
# APNS_KEY_FILE=""
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Deploy webhook -- Coolify -> HealthLog auto-deploy feedback
|
|
# -----------------------------------------------------------------------------
|
|
# DEPLOY_WEBHOOK_SECRET=""
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Off-host backups -- all-or-none
|
|
# -----------------------------------------------------------------------------
|
|
# BACKUP_S3_ENDPOINT=""
|
|
# BACKUP_S3_BUCKET=""
|
|
# BACKUP_S3_ACCESS_KEY=""
|
|
# BACKUP_S3_SECRET_KEY=""
|
|
# BACKUP_ENCRYPTION_KEY=""
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# FHIR health-record export -- optional
|
|
# -----------------------------------------------------------------------------
|
|
# Per-export ceiling on the number of MedicationAdministration rows in the
|
|
# FHIR Bundle. The report window already scopes the set; this is a coarse
|
|
# safety ceiling on the serialised Bundle size. Bounded 1..50000; any unset
|
|
# or out-of-range value falls back to the default of 5000. Raise it only for
|
|
# an unusual multi-year, many-medication workload.
|
|
# FHIR_MAX_MEDICATION_ADMINISTRATIONS="5000"
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Dashboard snapshot -- BUILD-TIME toggle (default ON)
|
|
# -----------------------------------------------------------------------------
|
|
# The dashboard hydrates every above-the-fold tile from the single
|
|
# `GET /api/dashboard/snapshot` cell so the whole strip shares one
|
|
# completion moment. This is the default and the desired behaviour.
|
|
#
|
|
# `NEXT_PUBLIC_*` vars are inlined into the client bundle at BUILD time,
|
|
# not read at runtime -- so this has NO effect on the prebuilt GHCR
|
|
# image and is intentionally absent from the `docker-compose.yml`
|
|
# runtime `environment:` whitelist. To fall back to the legacy
|
|
# four-cell path you must rebuild the image with the var set to "false":
|
|
#
|
|
# $ NEXT_PUBLIC_DASHBOARD_SNAPSHOT=false pnpm build # or a Dockerfile ARG
|
|
#
|
|
# NEXT_PUBLIC_DASHBOARD_SNAPSHOT="false"
|