Environment Setup Guide

Why .env file?

The .env file is not committed to git for security reasons. It contains sensitive information like:

• Database passwords
• API keys
• JWT secrets
• Internal service credentials

Setup Steps

1. Copy the example file

cp .env.example .env

2. Update Required Values

Edit .env and update these critical values:

Database Configuration

DATABASE_PASSWORD=your_actual_database_password

Rails Secret

Generate a new secret:

bin/rails secret

Then update:

SECRET_KEY_BASE=<output_from_rails_secret>

JWT Secret

This should match the JWT secret on HH-Server:

JWT_SECRET=your_shared_jwt_secret_minimum_256_bits

HH-Server Configuration

HH_SERVER_BASE_URL=http://localhost:3000  # Or production URL
HH_SERVER_API_KEY=your_hh_server_api_key

Internal API Key (Critical!)

This key is already generated in your .env file. You need to:

1. Copy this key from .env:

   INTERNAL_API_KEY=fc35925c5dc932637ff97f91533095f43a1af76d1b2e8c7ed3300e2ef24a2698
   

2. Add the SAME key to HH-Server’s .env:

   # In HH-Server's .env file
   INTERNAL_API_KEY=fc35925c5dc932637ff97f91533095f43a1af76d1b2e8c7ed3300e2ef24a2698
   PRICING_ENGINE_BASE_URL=http://localhost:3002  # Or production URL
   PRICING_ENGINE_SYNC_ENABLED=true
   

Important: Both services must use the exact same INTERNAL_API_KEY

3. Verify Setup

Check that your .env file is loaded:

# Start Rails console
bin/rails console

# Check if environment variables are loaded
ENV['INTERNAL_API_KEY']
# => "fc35925c5dc932637ff97f91533095f43a1af76d1b2e8c7ed3300e2ef24a2698"

ENV['JWT_SECRET']
# => "your_jwt_secret_here_minimum_256_bits"

Security Best Practices

✅ DO:

• Keep .env in .gitignore (already done)
• Use different values for development/staging/production
• Rotate keys regularly (especially in production)
• Use secrets management in production (AWS Secrets Manager, HashiCorp Vault, etc.)

❌ DON’T:

• Never commit .env to version control
• Never share .env via Slack/email
• Never use development keys in production
• Never reuse the same INTERNAL_API_KEY across multiple environments

Production Deployment

For production, set environment variables using your platform:

Heroku

heroku config:set INTERNAL_API_KEY=fc35925c5dc932637ff97f91533095f43a1af76d1b2e8c7ed3300e2ef24a2698 --app pricing-engine
heroku config:set JWT_SECRET=your_production_jwt_secret --app pricing-engine

AWS ECS/EKS

Use AWS Secrets Manager and reference in task definition:

{
  "secrets": [
    {
      "name": "INTERNAL_API_KEY",
      "valueFrom": "arn:aws:secretsmanager:region:account:secret:pricing-engine/internal-api-key"
    }
  ]
}

Docker Compose

services:
  pricing-engine:
    environment:
      - INTERNAL_API_KEY=${INTERNAL_API_KEY}
    env_file:
      - .env

Regenerating Keys

If you need to regenerate the INTERNAL_API_KEY:

# Generate new key
ruby -e "require 'securerandom'; puts SecureRandom.hex(32)"

# Update in both .env files (Pricing Engine AND HH-Server)
# Then restart both services

Troubleshooting

“Unauthorized” errors on internal API

• Check that INTERNAL_API_KEY is identical in both services
• Verify the key is loaded: ENV['INTERNAL_API_KEY'] in Rails console
• Check logs for authentication errors

JWT validation failing

• Ensure JWT_SECRET matches between HH-Server and Pricing Engine
• Check token expiration times

HH-Server webhook calls failing

• Verify PRICING_ENGINE_BASE_URL on HH-Server points to correct host
• Check network connectivity between services
• Review Pricing Engine logs for incoming webhook requests