# Shop Manager POS: selling setup

## 1. Prepare your owner licence issuer once

Do this on **your own computer only**, not on a customer computer.

```powershell
$env:POS_PORTAL_PASSWORD = "use-a-long-private-password"
python license_portal.py
```

Open `http://127.0.0.1:5050`. The first start creates:

- `license_private_key.pem` — owner-only secret. Back it up privately; never ship it.
- `license_public_key.pem` — safe to include with every customer POS installation.

Copy only `license_public_key.pem` into the POS application folder before making the installer.

## 2. Customer installation and 7-day trial

The POS starts a 7-day trial automatically. The customer opens `/activation` and sends you the displayed activation request code. In the issuer, paste the code, set the customer name and licence duration, then copy the generated activation key back to that POS.

The key is signed by your private key and tied to the Windows device ID. A copied key does not activate another computer.

## 3. Production environment

Set these values in the installer or service environment:

```text
POS_INITIAL_ADMIN_PASSWORD=<a-strong-one-time-password>
POS_SECRET_KEY=<long-random-secret>
POS_LICENSE_ENFORCEMENT=1
POS_DEBUG=0
```

The POS creates a per-installation secret automatically if `POS_SECRET_KEY` is not set. The initial admin password is printed only when the first admin account is created. Change it after first login.

## 4. Before delivery checklist

- Install the exact printer driver and choose 80 mm paper in its preferences.
- Run a sale, a return, a due collection, a stock adjustment, a backup and a restore test.
- Confirm that a cashier cannot access user, backup or shop-settings pages.
- Keep the customer database backup outside the POS folder as well.
- Package the app into an installer/executable. Do not deliver source code, `.app_secret`, `shop.db` test data, or the licence private key.

## Important limitation

Device binding is a strong business control, not absolute DRM. A determined technical attacker can modify an offline desktop program. For revocation and stronger copy protection, run a hosted licence validation service and require a periodic online verification.