env the fuckin ssl shit man why not

src/get_sq_env.py

@@ -6,6 +6,14 @@ dotenv.load_dotenv()
 
 LEGO_CAT_ID = os.getenv("SQUARE_LEGO_CAT_ID")
 
+# SSL Certificate paths (optional - for direct HTTPS, not needed with nginx)
+SSL_CERT_PATH = os.getenv("SSL_CERT_PATH")
+SSL_KEY_PATH = os.getenv("SSL_KEY_PATH")
+
+# P7B certificate for Square webhook signature verification
+# This is uploaded to Square Dashboard, not used by the server
+SQUARE_P7B_PATH = os.getenv("SQUARE_P7B_PATH")
+
 if os.getenv("SQUARE_ENV") == "production":
     SQUARE_APP_ID = os.getenv("PROD_SQUARE_APP_ID")
     SQUARE_TOKEN = os.getenv("PROD_SQUARE_TOKEN")

src/test_server.py

@@ -225,44 +225,74 @@ app = web.Application()
 app.router.add_post("/api", request_handler)
 app.router.add_post("/hook", hook_handler)
 
-parser = argparse.ArgumentParser(description="studspider")
+parser = argparse.ArgumentParser(
+    description="studspider - LEGO Inventory Sync Service for Square POS and Brickset",
+    epilog="""
+Examples:
+  # Basic HTTP server (recommended with nginx reverse proxy)
+  python src/test_server.py --host 0.0.0.0 --port 7432
+
+  # With separate webhook port
+  python src/test_server.py --port 7432 --hook-port 8080
+
+  # HTTPS using certificates from .env (set SSL_CERT_PATH and SSL_KEY_PATH)
+  python src/test_server.py --hook-port 8443 --hook-ssl-only
+
+  # HTTPS with command line override (self-signed cert for testing)
+  python src/test_server.py --ssl-cert cert.pem --ssl-key key.pem --hook-port 8443 --hook-ssl-only
+
+  # Full HTTPS (both endpoints)
+  python src/test_server.py --ssl-cert cert.pem --ssl-key key.pem --hook-port 8443
+
+  # Production behind nginx (no SSL needed in app)
+  python src/test_server.py --host 127.0.0.1 --port 7432
+
+Environment Variables (.env):
+  SSL_CERT_PATH       - Default SSL certificate path
+  SSL_KEY_PATH        - Default SSL key path  
+  SQUARE_P7B_PATH     - P7B file to upload to Square Dashboard
+
+For more information, see doc/ 
+    """,
+    formatter_class=argparse.RawDescriptionHelpFormatter,
+)
 parser.add_argument(
     "--host",
     type=str,
     default="localhost",
-    help="IP address to listen on. default: localhost",
+    help="IP address to listen on (default: localhost, use 0.0.0.0 for all interfaces)",
 )
 parser.add_argument(
-    "--port", type=int, default=7432, help="Port to listen on. default: 7432"
+    "--port", type=int, default=7432, help="Port for main API endpoint (default: 7432)"
 )
 parser.add_argument(
     "--hook-port",
     type=int,
-    default=8080,
+    default=None,
-    help="Optional separate port for webhook endpoint. default: 8080",
+    help="Separate port for webhook endpoint (default: None - uses same port as --port)",
 )
 parser.add_argument(
     "--ssl-cert",
     type=str,
-    default=None,
+    default=get_sq_env.SSL_CERT_PATH,
-    help="Path to SSL certificate file for HTTPS (PEM format)",
+    help="Path to SSL certificate file in PEM format (default: from .env SSL_CERT_PATH)",
 )
 parser.add_argument(
     "--ssl-key",
     type=str,
-    default=None,
+    default=get_sq_env.SSL_KEY_PATH,
-    help="Path to SSL private key file for HTTPS (PEM format)",
+    help="Path to SSL private key file in PEM format (default: from .env SSL_KEY_PATH)",
 )
 parser.add_argument(
     "--hook-ssl-only",
     action="store_true",
-    help="Enable HTTPS only for webhook endpoint (main server stays HTTP)",
+    help="Enable HTTPS only for webhook endpoint, main API stays HTTP (requires --ssl-cert and --ssl-key)",
 )
 args = parser.parse_args()
 
 if __name__ == "__main__":
     print(banner.generate("studspider v0.1"))
-    print("Built for PLAY-WELL TEKNOLOGIES by contact@traps.moe\n\n")
+    print("Built for PLAY-WELL TEKNOLOGIES by contact@studspider.sh\n\n")
 
     # Setup SSL context if certificates provided
     ssl_context = None
@@ -288,6 +318,16 @@ if __name__ == "__main__":
             ssl_context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
             ssl_context.load_cert_chain(args.ssl_cert, args.ssl_key)
             print(f"✓ SSL enabled with cert: {args.ssl_cert}")
+
+            # Show P7B info if configured
+            if get_sq_env.SQUARE_P7B_PATH:
+                print(
+                    f"ℹ️  Square P7B certificate for upload: {get_sq_env.SQUARE_P7B_PATH}"
+                )
+                if os.path.exists(get_sq_env.SQUARE_P7B_PATH):
+                    print(f"   ✓ P7B file exists")
+                else:
+                    print(f"   ⚠️  P7B file not found - run: python convert_to_p7b.py")
         except FileNotFoundError as e:
             print(f"ERROR: Certificate file not found: {e}")
             exit(1)
@@ -304,6 +344,20 @@ if __name__ == "__main__":
         print("   For production with nginx reverse proxy, this is recommended.")
         print("   Nginx will handle HTTPS, forward HTTP to this server.")
 
+        # Show P7B info even without SSL (for nginx setup)
+        if get_sq_env.SQUARE_P7B_PATH:
+            print(
+                f"\nℹ️  Square P7B certificate configured: {get_sq_env.SQUARE_P7B_PATH}"
+            )
+            if os.path.exists(get_sq_env.SQUARE_P7B_PATH):
+                print(f"   ✓ P7B file exists - upload this to Square Dashboard")
+                print(f"   Square Dashboard → Webhooks → Manage Notification Settings")
+            else:
+                print(f"   ⚠️  P7B file not found")
+                print(
+                    f"   Generate with: python convert_to_p7b.py --cert /path/to/nginx/cert.pem"
+                )
+
     # If hook-port is specified, run a separate server for webhooks
     if args.hook_port:
         protocol_main = "https" if (ssl_context and not args.hook_ssl_only) else "http"