Sam Rolfe
09639c5125
The morning briefs go out through the house Apprise API on `.35:8210`: one brief per boy and one combined brief to Jo and Sam (FR-9, FR-14). The service names an Apprise tag (`harry_email`, `joanna_whatsapp`, ...) and never holds an address, a phone number or an SMTP password (AGENTS.md §10 rule 3). - internal/apprise: keyed and stateless client, tag filtering, and error redaction so nothing sensitive reaches a log, a row or a screen. - internal/brief: builds the per-boy and the combined brief, delivers on email and WhatsApp, records every attempt in `notifications` (migration 004 adds scope, channel, tag, ok and error) and fails loudly. - Send panel (§5 screen 4): recipients, channels, an exact preview, Send now, plus the Send action on a stored draft (FR-10). The dashboard shows a Morning briefs banner and the Sends list. - POST /notify/morning: the bearer-token endpoint the 6:00am n8n schedule calls. 207 when a channel or a scan failed; `dry_run=1` checks the wiring without messaging the family. - scripts/morning-brief.sh: scan both children, then send. It is the n8n job; deploy/n8n-morning-brief.json is the ready-to-import workflow (06:00 daily). - FR-12: a failed scan is never "nothing due" -- the brief says so, and the run exits non-zero. A failed delivery is recorded with no sent_at. - The long no-due-date tail is capped in the sent brief so it stays brief (§10 rule 6); overdue work is never capped. Verified live: 8 deliveries recorded (4 email, 4 WhatsApp) with HTTP 200 and sent_at, and the endpoint answers 401/200/207 as documented. Evidence in docs/phase-7-notify-notes.md. Co-Authored-By: Paperclip <noreply@paperclip.ing>
77 lines
3.2 KiB
Plaintext
77 lines
3.2 KiB
Plaintext
# Compass / NHS — service environment (EXAMPLE).
|
|
#
|
|
# Copy to environment.d/school-service.env and fill the secrets in. The real
|
|
# file is gitignored; never commit it. Generate values with:
|
|
# docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 gen-secret
|
|
# docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 hash-password 'the-password'
|
|
|
|
# Listen address inside the container. The host maps 8792 -> 8792.
|
|
SCHOOL_ADDR=:8792
|
|
|
|
# SQLite database in the named volume.
|
|
SCHOOL_DB_PATH=/data/school.db
|
|
|
|
# Signs the session cookie. Required, >= 16 characters. Secret.
|
|
SCHOOL_SESSION_SECRET=change-me-32-bytes-of-random
|
|
|
|
# The single dashboard login (Sam). Prefer the bcrypt hash over the plaintext.
|
|
SCHOOL_ADMIN_USERNAME=sam
|
|
SCHOOL_ADMIN_PASSWORD_HASH=
|
|
SCHOOL_ADMIN_PASSWORD=
|
|
|
|
# Keep true behind HTTPS (Caddy terminates TLS).
|
|
SCHOOL_COOKIE_SECURE=true
|
|
SCHOOL_SESSION_TTL=12h
|
|
|
|
# Family timezone for due dates and briefs.
|
|
SCHOOL_TIMEZONE=Australia/Sydney
|
|
|
|
SCHOOL_LOG_LEVEL=info
|
|
SCHOOL_APP_ENV=production
|
|
|
|
# ---- Home Assistant calendar (AGENTS.md §4 FR-8, Phase 6) -------------------
|
|
# Important school events are written to Sam's Home Assistant calendar through
|
|
# the Home Assistant REST API. Nothing is written until all three of URL, token
|
|
# and entity are set; the dashboard shows CALENDAR NOT CONFIGURED until then.
|
|
#
|
|
# The token is a long-lived access token created on Sam's Home Assistant
|
|
# profile page. It is a SECRET: keep it in this file only.
|
|
SCHOOL_HA_URL=http://192.168.20.30:8123
|
|
SCHOOL_HA_TOKEN=
|
|
# The calendar entity to write to. Discover the real ids with:
|
|
# scripts/calendar-push.sh entities
|
|
SCHOOL_HA_CALENDAR_ENTITY=calendar.school
|
|
# The internal .lab Caddy certificate is not in the container trust store.
|
|
# Set true only when SCHOOL_HA_URL is the https://homeassistant.home.lab URL.
|
|
SCHOOL_HA_INSECURE=false
|
|
SCHOOL_HA_TIMEOUT=20s
|
|
|
|
# ---- Apprise notifications (AGENTS.md §4 FR-9/FR-14, §11 Phase 7) ----------
|
|
# The morning briefs go out through the house Apprise API on `.35:8210`. The
|
|
# Apprise configuration holds every destination (email address, WhatsApp number,
|
|
# SMTP password); this service only names a tag such as "harry_email", so no
|
|
# address or password is ever stored here or committed (AGENTS.md §10 rule 3).
|
|
#
|
|
# Create the stored configuration once in the Apprise web UI
|
|
# (https://apprise.lab.audasmedia.com.au), then copy its key here. The key acts
|
|
# like a password: keep it in this file only, never in git.
|
|
SCHOOL_APPRISE_URL=http://192.168.20.35:8210
|
|
SCHOOL_APPRISE_KEY=
|
|
# Optional bearer token if the Apprise API is protected. Empty in this lab.
|
|
SCHOOL_APPRISE_TOKEN=
|
|
SCHOOL_APPRISE_TIMEOUT=15s
|
|
|
|
# Channels the morning brief uses (AGENTS.md §13 decision 8). Each recipient
|
|
# needs a tag per channel: <tag base>_email and <tag base>_whatsapp.
|
|
SCHOOL_APPRISE_CHANNELS=email,whatsapp
|
|
|
|
# Recipients: Name=tag-base. The boys are children in the database and get their
|
|
# own brief; the rest are parents and get one combined brief (FR-9, FR-14).
|
|
SCHOOL_APPRISE_TAGS=Harry=harry,Finn=finn,Jo=joanna,Sam=sam
|
|
SCHOOL_APPRISE_PARENTS=Jo,Sam
|
|
|
|
# Bearer token for POST /notify/morning, the endpoint n8n calls at 6:00am.
|
|
# Generate one and keep it here:
|
|
# docker run --rm --entrypoint /app/school <image> gen-secret
|
|
SCHOOL_NOTIFY_TOKEN=
|