Add deployment files

.env.example

@@ -0,0 +1,50 @@
+# Copy this file to /opt/vigilcare-records/.env on the deploy host (chmod 600).
+# CD never uploads or overwrites this file — only the IMAGE_TAG line is patched
+# automatically on each release. See docs/26-vigilcare-records-cicd.md.
+
+# ---- image coordinates ----
+REGISTRY=git.vectur45.com/trent/vigilcare-records
+IMAGE_TAG=v1.0.0
+
+# ---- exposed ports on the production host ----
+API_PORT=5217
+DASHBOARD_PORT=8089
+DASHBOARD_ORIGIN=https://vigilcare-records.vectur45.com
+
+# ---- PostgreSQL ----
+# VigilCare Records shares one PostgreSQL instance with VigilCareClinical on the
+# same host (see docs/vigilcare-records-clinical-overview.md — "Integrated Database
+# Deployment"). "postgres" below is the service name on the "shared-services"
+# Docker network already created by VigilCareClinical's own compose project; that
+# stack MUST be up before the first `docker compose -f docker-compose.prod.yml up`.
+# Runtime (DML-only) connection used by the API container.
+PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare_records;Username=vigilcare_records_app;Password=CHANGE_ME;SSL Mode=Disable"
+# DDL-privileged connection used ONLY by the EF migration bundle (CD migrate job).
+# That job runs on the act_runner host directly (not joined to shared-services), so
+# it needs the externally-routable host:port, not the container network name.
+# Never put this credential in the API container environment.
+PG_CONNECTION_DDL="Host=postgres.site.com;Port=5432;Database=vigilcare_records;Username=vigilcare_records_migrator;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false"
+
+# ---- Redis (shared-services network) ----
+# "redis" = the service name on the shared Redis compose project.
+# Use a dedicated logical database so Records' batch-assignment locks never
+# collide with VigilCareClinical's own Redis keys.
+REDIS_CONNECTION=redis:6379,abortConnect=false,defaultDatabase=2
+
+# ---- MinIO (shared-services network) ----
+# "minio" = the service name on the shared MinIO compose project. Records stores
+# scanned documents under its own bucket, separate from any clinical buckets.
+MINIO_ENDPOINT=minio:9000
+MINIO_ACCESS_KEY=admin
+MINIO_SECRET_KEY=CHANGE_ME
+MINIO_BUCKET_NAME=vigilcare-records-scans
+MINIO_USE_SSL=false
+
+# ---- Seq (shared-services network) ----
+SEQ_URL=http://seq:80
+SEQ_API_KEY=CHANGE_ME
+
+# ---- application secrets (generate with: openssl rand -base64 48) ----
+JWT_SECRET=CHANGE_ME_AT_LEAST_32_BYTES
+JWT_ISSUER=VigilCareRecords
+JWT_AUDIENCE=VigilCareRecords