Padreug
f11aced450
ADR-003, .env.example, the access module's headers and the provisioning schema still described the planned npub-QR → UID → serial-reader path. What shipped (#86) is Bolt Card tap-to-enter over the main-process pcscd reader with external_id as the identity, soft entry and verify-at-payment. Nothing ever called availableAccessReaders(): the camera npub-QR reader, the mock reader and the AccessReader seam were dead, so they go; services/access now holds authorize, the card parser and the credential types. The unused 'uid' scan variant goes with them; 'npub' (+PIN) and the 'challenge' seam stay. The ADR gets an amendment section recording the differences, including that open enrollment is not a security boundary and that the audit is still a stub (both tracked as issues). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
123 lines
5.7 KiB
Bash
123 lines
5.7 KiB
Bash
# bitSpire ATM Configuration
|
|
# Copy this file to .env and fill in your values
|
|
|
|
# =============================================================================
|
|
# Hardware Configuration
|
|
# =============================================================================
|
|
|
|
# Machine model preset (sintra, gaia, or custom)
|
|
VITE_LAMASSU_MACHINE_MODEL=sintra
|
|
|
|
# Fiat currency code (ISO 4217)
|
|
VITE_LAMASSU_FIAT_CODE=USD
|
|
|
|
# Custom device paths (optional - uses preset defaults if not set)
|
|
# VITE_LAMASSU_VALIDATOR_DEVICE=/dev/ttyJ5
|
|
# VITE_LAMASSU_DISPENSER_DEVICE=/dev/ttyJ7
|
|
|
|
# Cassette configuration (optional - JSON array)
|
|
# VITE_LAMASSU_CASSETTES='[{"denomination":20,"count":100}]'
|
|
|
|
# =============================================================================
|
|
# LNbits Connection (dev override — normally seed-provided) — nostr-native-transport
|
|
# =============================================================================
|
|
# On a real machine the pairing SEED (VITE_SPIRE_SEED) carries the relay AND the
|
|
# server pubkey (aiolabs/bitspire#70), so leave both blank there. Set them here
|
|
# only for browser dev without a seed/bunker — they WIN over the seed.
|
|
|
|
# Nostr relay WebSocket URL. Dev stack uses LNbits's bundled nostrrelay:
|
|
# VITE_RELAY_URL=ws://localhost:5001/nostrrelay/test
|
|
VITE_RELAY_URL=
|
|
|
|
# LNbits nostr-transport server pubkey (hex, 64 chars).
|
|
# Printed by the LNbits server on startup:
|
|
# docker logs lnbits | grep 'nostr_transport pubkey'
|
|
VITE_LNBITS_SERVER_PUBKEY=
|
|
|
|
# (LNbits HTTP URL is no longer needed on the ATM side — the
|
|
# nostr-transport RPC `lnurlw_create_link` now returns `link.lnurl`
|
|
# populated from `settings.lnbits_baseurl` on the LNbits server. See
|
|
# aiolabs/withdraw#1 / commit e9d911e.)
|
|
|
|
# =============================================================================
|
|
# ATM Identity — spire pairing seed (NIP-46 bunker; aiolabs/bitspire#52)
|
|
# =============================================================================
|
|
|
|
# The spire pairing seed produced by the operator dashboard (spirekeeper):
|
|
# spire-seed:v1:<base64url>
|
|
# It carries a one-shot NIP-46 connect token + the spire's signing pubkey +
|
|
# the bunker URL. On first boot the ATM redeems the token, generates its own
|
|
# transport key, and persists the binding to state.db; thereafter it resumes
|
|
# from the binding (the seed can stay set — it's matched by fingerprint).
|
|
# A changed seed re-pairs (and re-publishes the cassette-state hello).
|
|
VITE_SPIRE_SEED=
|
|
|
|
# pragma: allowlist secret
|
|
# DEV ONLY fallback — a raw Nostr private key (hex, 64 chars) for running
|
|
# without a bunker. Ignored when VITE_SPIRE_SEED or a stored binding exists.
|
|
# Generate with: openssl rand -hex 32
|
|
# VITE_ATM_PRIVATE_KEY=
|
|
|
|
# =============================================================================
|
|
# Operator Identity
|
|
# =============================================================================
|
|
|
|
# Comma-separated list of Nostr hex pubkeys authorized to send operator commands
|
|
# (manual dispense, remote management).
|
|
# VITE_OPERATOR_PUBKEYS=abcd1234...,ef567890...
|
|
|
|
# =============================================================================
|
|
# Maintenance Mode
|
|
# =============================================================================
|
|
|
|
# Show "Under Service" screen and block all transactions
|
|
# VITE_MAINTENANCE_MODE=true
|
|
|
|
# =============================================================================
|
|
# Public Web Demo
|
|
# =============================================================================
|
|
|
|
# Set ONLY for the browser demo build (atm.demo.aiolabs.dev). Leave blank on
|
|
# every real machine. When set it:
|
|
# - keeps the mouse cursor visible (kiosk builds hide it)
|
|
# - mints one extra, never-used LNbits wallet named with this exact string,
|
|
# so the throwaway accounts the demo creates (one per page load, each with
|
|
# its own ephemeral identity) can be swept by name instead of guessed at.
|
|
# VITE_DEMO_TAG=bitspire-web-demo
|
|
|
|
# =============================================================================
|
|
# Mock Fallback (Production Safety)
|
|
# =============================================================================
|
|
|
|
# Allow fallback to mock services when hardware/Lightning fails (default: false)
|
|
# Set to 'true' for development/demo environments only
|
|
# When false (production default), initialization failures show a maintenance screen
|
|
# VITE_ALLOW_MOCK_FALLBACK=true
|
|
|
|
# =============================================================================
|
|
# Access Control (ADR-003)
|
|
# =============================================================================
|
|
|
|
# Tap-to-enter gate. When disabled (default), the machine boots straight to
|
|
# idle exactly as before. When enabled, it boots into a locked screen and a
|
|
# Bolt Card tap (read by the main-process NFC service over pcscd) unlocks it
|
|
# and loads the card for the session, so buy/sell finish with one Complete.
|
|
# ACCESS_CONTROL_ENABLED=true
|
|
|
|
# Admit ANY Bolt Card when the allow-list has no match. With this on the gate
|
|
# only keeps casual users off the menu — any NDEF tag with a /scan/<id> URL
|
|
# unlocks it; money still moves only on a valid SUN at Complete. Turn OFF once
|
|
# a real allow-list (/var/lib/bitspire/access.json) is provisioned.
|
|
# ACCESS_OPEN_ENROLLMENT=true
|
|
|
|
# Show the on-screen runtime dev/operator unlock button on the locked screen.
|
|
# Default OFF — it bypasses the gate, so enable only on a bench/dev machine.
|
|
# ACCESS_DEV_UNLOCK=true
|
|
|
|
# Per-machine salt for hashing credentials/PINs. Provision a real value in
|
|
# production (or in access.json); a fixed default is used if unset.
|
|
# ACCESS_SALT=change-me-per-machine
|
|
|
|
# Build/dev bypass — forces the gate OPEN even when enabled (browser dev / CI).
|
|
# Renderer-side (Vite) flag, never set in a production image.
|
|
# VITE_SKIP_ACCESS_GATE=true
|