security + reponsive

.env.example

@@ -0,0 +1,45 @@
+NODE_ENV=production
+APP_PORT=3000
+PORT=3000
+TZ=Asia/Ho_Chi_Minh
+APP_TIME_ZONE=Asia/Ho_Chi_Minh
+
+# Database: never commit real credentials.
+DB_SERVER=sql-server.internal
+DB_USER=accmanager_app
+DB_PASSWORD=replace-with-a-strong-database-password
+DB_NAME=AccManager
+DB_ENCRYPT=true
+DB_TRUST_CERTIFICATE=false
+DB_CONNECT_TIMEOUT=30000
+
+# Generate a separate random value of at least 32 bytes and keep it stable.
+# Changing this value without a key-rotation migration will make stored
+# application credentials unreadable.
+DATA_ENCRYPTION_SECRET=replace-with-at-least-32-random-bytes
+BCRYPT_ROUNDS=12
+
+# Public HTTPS origin used by email links, CORS and secure cookies.
+APP_BASE_URL=https://accmanager.example.internal
+CORS_ALLOWED_ORIGINS=https://accmanager.example.internal
+COOKIE_SECURE=true
+TRUST_PROXY_HOPS=1
+SESSION_TTL_HOURS=12
+REMEMBER_SESSION_TTL_DAYS=14
+ALLOW_SELF_REGISTRATION=false
+
+# Only needed once when bootstrapping an empty database. Remove the password
+# from the environment after the first administrator has been created.
+INITIAL_ADMIN_USERNAME=admin
+INITIAL_ADMIN_PASSWORD=
+INITIAL_ADMIN_EMAIL=admin@example.internal
+
+SMTP_HOST=
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_REQUIRE_TLS=true
+SMTP_USER=
+SMTP_PASS=
+SMTP_FROM=
+EMAIL_VERIFY_TOKEN_TTL_MINUTES=30
+PASSWORD_RESET_TOKEN_TTL_MINUTES=30