flask and node.js solution

.env

@@ -1,6 +1,14 @@
-# VAPID Keys for Web Push
-VAPID_PRIVATE_KEY=
-VAPID_PUBLIC_KEY=
+# --- Application Configuration ---
+
+# --- VAPID Keys (REQUIRED for Web Push) ---
+# Generate these once using npx web-push generate-vapid-keys (or other tools)
+# Keep the private key SECRET!
+VAPID_PUBLIC_KEY="BKfRJXjSQmAJ452gLwlK_8scGrW6qMU1mBRp39ONtcQHkSsQgmLAaODIyGbgHyRpnDEv3HfXV1oGh3SC0fHxY0E"
+VAPID_PRIVATE_KEY="ErEgsDKYQi5j2KPERC_gCtrEALAD0k-dWSwrrcD0-JU"
+
+# Subject claim for VAPID. Use a 'mailto:' URI or an 'https:' URL identifying your application.
+# Example: mailto:admin@yourdomain.com or https://yourdomain.com/contact
+VAPID_SUBJECT="mailto:admin@virtonline.eu"
 
 # Flic Button Configuration
 FLIC_BUTTON1_SERIAL=your_button1_serial
@@ -8,10 +16,17 @@ FLIC_BUTTON2_SERIAL=your_button2_serial
 FLIC_BUTTON3_SERIAL=your_button3_serial
 
 # Subscription Storage
-SUBSCRIPTIONS_FILE=data/subscriptions.json
+SUBSCRIPTIONS_FILE=subscriptions.json
+
+# CORS
+ALLOWED_ORIGINS=https://game-timer.virtonline.eu
+ALLOWED_METHODS=POST,OPTIONS
+ALLOWED_HEADERS=Content-Type,Authorization
 
 # Logging Configuration
-LOG_LEVEL=INFO
+LOG_LEVEL=DEBUG
 
-# VAPID Claim Email
-VAPID_CLAIM_EMAIL=mailto:your-email@example.com
+# --- Security (Optional) ---
+# If you want to add a simple security layer between Flic and this app.
+# If set, configure Flic's HTTP request to include an "Authorization: Bearer YOUR_SECRET_VALUE" header.
+# FLIC_SECRET="replace_with_a_strong_secret_if_needed"