.env.example

# =============================================================================
# Promocean — one-command compose stack contract.
#
#   cp .env.example .env
#   docker compose --profile stack up -d --wait
#
# docker compose auto-loads this file (as .env) from the repo root. Every
# variable read by a service in docker-compose.yml is documented here. The
# in-network service URLs (postgres:5432, cms:1337, api:3001) are fixed inside
# docker-compose.yml and are NOT configured here.
#
# The values below are working DEMO defaults — fine for local evaluation.
# Rotate every secret before any non-local deployment.
# =============================================================================

# --- Strapi secrets (CMS) ----------------------------------------------------
# APP_KEYS is a comma-separated list; the rest are single secrets.
APP_KEYS=mAKne60TY0QOJMNUNCDycg==,U/rEOPAmrAew5FiwZ+pSlQ==,Hlysyc4MZF99iRE70R05bg==,9ucJZc3CRVonKa4Pj9vgkQ==
API_TOKEN_SALT=Yg6N381jwuVHDjHZYtDqfw==
ADMIN_JWT_SECRET=YXWKrbvzeQddIrgedorS7g==
TRANSFER_TOKEN_SALT=8AA/neE0ev/Ds/YfhMUfYw==
JWT_SECRET=xBJyFXIuJKLhu2jkCiN6iA==
ENCRYPTION_KEY=10s+VhLba6/fA2fznlMCxg==

# --- Strapi admin seed (created on first boot if no admin exists) ------------
ADMIN_FIRST_NAME=Admin
ADMIN_LAST_NAME=User
ADMIN_EMAIL=admin@example.com
ADMIN_PASSWORD=changeMe123!

# --- Demo data seeding (CMS) -------------------------------------------------
# When true and the DB is empty, seeds the demo project + pk/sk test keys,
# achievements, placement/offer, and a live timed event.
SEED_DEMO=true
# Reveal seeded plaintext API keys in the CMS logs (dev convenience only).
LOG_PLAINTEXT_KEYS=false

# --- Shared config-plane secret (CMS <-> API) -------------------------------
CONFIG_PLANE_SECRET=dev-config-secret

# --- API tuning knobs (all have compose-level defaults) ----------------------
LOG_LEVEL=info
RATE_LIMIT_PER_MINUTE=300
RATE_LIMIT_MAX_BUCKETS=10000
WEBHOOK_REDELIVERY_GRACE_MINUTES=5
TIMED_EVENT_SCAN_GRACE_MINUTES=60
WEBHOOK_DEAD_LETTER_TTL_DAYS=30

# --- Demo app: browser-facing public config (BAKED at image BUILD time) ------
# These are inlined into the client bundle; only non-secret values belong here.
NEXT_PUBLIC_PROMOCEAN_KEY=pk_test_demo_1234567890abcdef
NEXT_PUBLIC_PROMOCEAN_API=http://localhost:3001

# --- Demo app: server-side secret key (RUNTIME env, never shipped to browser)
PROMOCEAN_SECRET_KEY=sk_test_demo_1234567890abcdef