1 files changed, 22 insertions, 3 deletions
diff --git a/config.ts.sample b/config.ts.sample
index 299b04ca..80162f5f 100644
--- a/config.ts.sample
+++ b/config.ts.sample
@@ -1,3 +1,5 @@
+import { SquareEnvironment } from "square";
+
 export default {
   archive: "redis://archive",
   db: "redis://db",
@@ -10,7 +12,10 @@ export default {
     "wss://relay.nostr.bg",
     "wss://nostr.orangepill.dev"
   ],
-  jwt: "00d0ab4f7738a83feb37f661526512063c41e49278b7c32cba87314269a5788b",
+  // SECURITY: generate a fresh 32-byte secret before deploying —
+  // `openssl rand -hex 32`. This also keys @fastify/secure-session, so a
+  // published value lets anyone forge session JWTs and read the session cookie.
+  jwt: "0000000000000000000000000000000000000000000000000000000000000000",
   bitcoin: {
     host: "bc",
     wallet: "coinos",
@@ -29,9 +34,23 @@ export default {
     btc: "5ac9f65c0efcc4775e0baec4ec03abdde22473cd3cf33c0419ca290e0751b225"
   },
   lightning: "/home/bun/app/data/lightning/regtest/lightning-rpc",
+  lightningb: "/home/bun/app/data/lightningb/regtest/lightning-rpc",
   fee: 0.001,
-  adminpass: "pwa",
+  // SECURITY: the admin login path is disabled when this is empty (fails
+  // closed). Set a strong, unique value only if you need admin impersonation;
+  // never ship the sample value.
+  adminpass: "",
   support: "[email protected]",
-  nostrKey: "nsec13wekuqstlsyfrzm369yh6vjaphslq5pq9kze74acqqynjm8lvpms4qzsx9",
+  // SECURITY: generate fresh keys — never deploy these sample values. These are
+  // the server NWC wallet-service key and the zap-receipt signer.
+  //   node -e "import('nostr-tools').then(n=>console.log(n.nip19.nsecEncode(n.generateSecretKey())))"
+  nostrKey: "nsec1replacewithafreshlygeneratedkeydonotusethissamplevalue0",
+  nostrKey2: "nsec1replacewithafreshlygeneratedkeydonotusethissamplevalue1",
   mintUrl: "http://mint:3338",
+  square: {
+    environment: SquareEnvironment.Sandbox,
+    appId: "sandbox-sq0adb-9QbyDZeHTPc_RhFSEr_SaQ",
+    url: "https://connect.squareupsandbox.com/",
+    scopes: ["MERCHANT_PROFILE_READ", "ORDERS_READ", "PAYMENTS_READ"],
+  },
 };