NODE_ENV=development

POSTGRES_USER=primora
POSTGRES_PASSWORD=primora
POSTGRES_DB=primora
POSTGRES_HOST=postgres
POSTGRES_PORT=5432
DATABASE_URL=postgres://primora:primora@postgres:5432/primora?sslmode=disable

DRAGONFLY_HOST=dragonfly
DRAGONFLY_PORT=6379
DRAGONFLY_URL=redis://dragonfly:6379/0
USER_RATE_LIMIT_PER_MINUTE=240
API_KEY_RATE_LIMIT_PER_MINUTE=600

JWT_ISSUER=primora-auth
JWT_AUDIENCE=primora-api
JWT_SECRET=change-me-super-long-jwt-secret
JWT_TTL_SECONDS=900

# AES-256 key (32 bytes, hex or base64) encrypting integration credentials and
# webhook secrets at rest. Required in production; dev falls back to this value.
PRIMORA_ENCRYPTION_KEY=3031323334353637383961626364656630313233343536373839616263646566

AUTH_PORT=3001
AUTH_BASE_URL=http://localhost/auth
AUTH_INTERNAL_BASE_URL=http://auth:3001
BETTER_AUTH_SECRET=change-me-super-long-better-auth-secret
BETTER_AUTH_URL=http://localhost/auth
# Comma-separated emails promoted to auth admin on boot (Authentication → Users panel)
AUTH_ADMIN_EMAILS=
# The first public sign-up always becomes the instance admin. With no users the
# login page shows only the sign-up form. After bootstrap, public sign-up is
# closed unless SIGNUP_ENABLED=true or the admin enables it in-app
# (Settings → Instance). In-app values override this file.
SIGNUP_ENABLED=false
# Managed tier flag — OAuth providers activate only when this is "true".
# Self-hosted instances are email/password regardless of the keys below.
PRIMORA_MANAGED=false
COOKIE_DOMAIN=localhost

FRONTEND_PORT=3000
VITE_APP_URL=http://localhost
VITE_AUTH_BASE_URL=http://localhost/auth
VITE_API_BASE_URL=http://localhost/api/v1
VITE_DEMO_MODE=false

BACKEND_PORT=8080
BACKEND_PUBLIC_URL=http://localhost/api/v1
BACKEND_INTERNAL_URL=http://backend:8080
BACKEND_STORAGE_ROOT=/data/storage

# Object storage driver: "local" (default, uses BACKEND_STORAGE_ROOT) or "s3".
# For s3, point S3_ENDPOINT at any S3-compatible API (AWS, MinIO, Garage, R2).
BACKEND_STORAGE_DRIVER=local
#S3_ENDPOINT=http://minio:9000
#S3_REGION=us-east-1
#S3_BUCKET=primora-objects
#S3_ACCESS_KEY_ID=
#S3_SECRET_ACCESS_KEY=
#S3_PREFIX=
#S3_PATH_STYLE=true
# Client-facing S3 endpoint for presigned URLs — set when S3_ENDPOINT is an
# internal address (e.g. http://minio:9000 inside compose) that browsers
# can't reach. Presigned URLs are valid only at the host they were minted for.
#S3_PUBLIC_ENDPOINT=https://objects.example.com

# Mail defaults — each is overridable in-app (Settings → Instance). In-app
# values win over these env vars; deleting the in-app value reverts here.
RESEND_API_KEY=
MAIL_FROM=Primora <no-reply@primora.local>
SMTP_HOST=mailpit
SMTP_PORT=1025
SMTP_USER=
SMTP_PASSWORD=
SMTP_SECURE=false

# OAuth keys only take effect when PRIMORA_MANAGED=true (managed tier).
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
MICROSOFT_TENANT_ID=

NGINX_PORT=80
MAILPIT_HTTP_PORT=8025