WELIFE Docs Swagger Admin Web

Environment variables — WELIFE

Status vocabulary only — never store real secrets in this doc. OWNER đăng ký dịch vụ: OWNER-GATES.md (Google → SMS → MoMo). Inventory: ENV-INVENTORY.md Bootstrap: npm run env:bootstrap · Check: npm run env:check

Files

File Role
.env / .env.example Docker Compose (Postgres/Redis/MinIO/Mailpit ports)
api/.env / .env.example Nest runtime (JWT, DB, Google, Pay, SMS…)
api/.env.production.example VPS template
mobile/.env · .env.local / .env.example Expo Consumer public only
partner/ · driver/ .env.example Expo thin
dashboard/.env / .env.example Vite Admin

.gitignore covers .env, .env.*, with !.env.example exceptions.

Map theo surface

┌─ root .env ────────── docker ports / compose passwords
├─ api/.env ─────────── secrets + server config (JWT, DB, Google verify, Pay, SMS)
├─ mobile/.env ──────── EXPO_PUBLIC_* only (API URL + Google Web Client ID)
├─ partner|driver/.env  EXPO_PUBLIC_* only
└─ dashboard/.env ───── VITE_API_URL

Cross-app pairing (bắt buộc khớp)

Client Server Notes
EXPO_PUBLIC_API_URL Nest /api/v1 Phải có /api/v1; device = LAN IP
EXPO_PUBLIC_WS_URL Socket.IO origin path /socket.io
EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID GOOGLE_CLIENT_ID Cùng Web OAuth audience
VITE_API_URL same API Dashboard

Google Sign-In (OWNER)

WELIFE dùng idToken (không Authorization Code) → không cần GOOGLE_CLIENT_SECRET trên API hiện tại.

Variable Where Required
GOOGLE_CLIENT_ID api/.env Yes để verify idToken
EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID mobile/.env(.local) Yes để bật nút Google
EXPO_PUBLIC_GOOGLE_ANDROID_CLIENT_ID mobile Native Android
EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID mobile Native iOS

Điền nhanh

# api/.env
GOOGLE_CLIENT_ID=xxxxx.apps.googleusercontent.com

# mobile/.env.local
EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID=xxxxx.apps.googleusercontent.com
EXPO_PUBLIC_GOOGLE_ANDROID_CLIENT_ID=
EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID=

npm run env:check
# restart API + npx expo start -c

Firebase Auth Hybrid (WP-AUTH-FIREBASE-HYBRID-01)

Variable Where Notes
EXPO_PUBLIC_FIREBASE_API_KEY / AUTH_DOMAIN / … mobile/.env.local Public SDK · project welife-2412
EXPO_PUBLIC_FIREBASE_WEB_APP_ID mobile Expo web — dạng 1:…:web:…
EXPO_PUBLIC_FIREBASE_ANDROID_APP_ID mobile Native · google-services.json
EXPO_PUBLIC_FIREBASE_IOS_APP_ID mobile Optional iOS
EXPO_PUBLIC_FIREBASE_APP_ID mobile Fallback; code resolve theo platform
EXPO_PUBLIC_FIREBASE_BRIDGE mobile 1 chỉ khi API có Admin SA
FIREBASE_PROJECT_ID / CLIENT_EMAIL / PRIVATE_KEY api/.env Admin verify · không EXPO_PUBLIC
GOOGLE_APPLICATION_CREDENTIALS api/.env Optional path to SA JSON
GOOGLE_CLIENT_IDS api/.env Thêm Firebase oauth clients (web popup)

Flow: Firebase sign-in → POST /auth/firebase { idToken } → WELIFE JWT. OWNER checklist: OWNER-FIREBASE-HYBRID.md.

MoMo / SMS naming (API)

Intent WELIFE env key Notes
MoMo return URL MOMO_RETURN_URL (+ alias MOMO_REDIRECT_URL) App redirect sau thanh toán
MoMo IPN MOMO_IPN_URL Server-to-server
MoMo env MOMO_ENV=sandbox|production Chọn endpoint nếu thiếu MOMO_ENDPOINT
Twilio TWILIO_ACCOUNT_SID / AUTH_TOKEN / FROM_NUMBER Không dùng EXPO_PUBLIC

Auth sessions (API)

Variable Notes
JWT_ACCESS_TTL / JWT_REFRESH_TTL Access ngắn · refresh dài
AUTH_REMEMBER_ME_TTL Remember-me
AUTH_SESSION_ABSOLUTE_TTL_DAYS Cap tuyệt đối
AUTH_MAX_LOGIN_ATTEMPTS / AUTH_LOCKOUT_SECONDS Lockout
AUTH_DEVICE_ID_PEPPER API-only — không EXPO_PUBLIC_*

API sections (trong .env.example)

  1. Runtime · 2. JWT/sessions · 3. OTP · 4. SMTP · 5. Google · 6. Admin
  2. Wallet · 8. Postgres · 9. Redis · 10. S3 · 11. Routing · 12. Payments · 13. SMS · 14. AI

OWNER_REQUIRED (live)

Variable Why
Google Web Client ID (API + mobile) Sign-In live
MoMo / VNPay keys Pay live (PAYMENTS_MOCK=false)
eSMS / Twilio SMS OTP live
OPENAI_API_KEY Assistant AI
EAS login Cloud builds

Production guards (API)