tech-stack/.env.example at master · michael-padin/tech-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
# ─────────────────────────────────────────────────────────────────────────
# Internal-Tools Starter — environment reference (SHARED ROOT)
# ─────────────────────────────────────────────────────────────────────────
# This is the shared reference file. Copy it to root `.env.local` — it's
# read by apps/web, apps/admin, AND the Prisma CLI tooling.
#
# How it's loaded:
#
#   • Each app's `dev` script runs through dotenv-cli, loading
#     `apps/<app>/.env.local` FIRST (per-app overrides win for duplicate
#     keys), then this root `.env.local` (shared vars fill in the rest).
#     See each app's slim `.env.example` for its per-app overrides.
#   • Prisma CLI tooling (the `db:*` scripts) reads this root `.env.local`
#     too, plus `.env.staging` / `.env.production` for the `db:*:staging` /
#     `db:*:prod` commands — see the stage-file note near the bottom of this
#     file.
#
# Every value below is a safe placeholder — replace before using in any real
# deployment.
#
# All variables are validated at boot by `@repo/env/*` (Zod schemas). Never
# read `process.env.X` directly in app code — import from the right env module.


# ── Database ──────────────────────────────────────────────────────────────
# Plain Postgres. Works with local Docker, Neon, Supabase, RDS, Railway, etc.
# The default below matches docker-compose.yml — run `pnpm db:up` to start it.
#
# OPTIONAL for the public web app: when DATABASE_URL is unset, apps/web falls
# back to the seed dataset (`@repo/db/seed-data`) so a fresh clone boots with
# zero setup. The admin app and any real DB query REQUIRE it.
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/app?schema=public
# Hosted example (Neon/Supabase/RDS) — use your provider's connection string:
# DATABASE_URL=postgresql://user:password@host/dbname?sslmode=require


# ── Authentication (Better Auth) ──────────────────────────────────────────
# Cookie-signing secret. MUST be ≥ 32 chars and MUST match across both apps
# in the same environment. Generate one with:
#   openssl rand -base64 32
BETTER_AUTH_SECRET=replace-with-32-bytes-of-randomness

# Canonical URL of THIS app — used for OAuth callbacks. Set per app:
#   web   → http://localhost:3000
#   admin → http://localhost:3001
BETTER_AUTH_URL=http://localhost:3001

# Optional Google OAuth. Leave both empty to hide the "Continue with Google"
# button. When set, the redirect URI is <BETTER_AUTH_URL>/api/auth/callback/google.
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=


# ── Public display + cross-app links (NEXT_PUBLIC_*) ──────────────────────
# Inlined into the browser bundle at build time.

# Display name shown across both apps (titles, sign-in, auth emails).
# Defaults to "Internal Tools" if unset. The rename script sets this per project.
NEXT_PUBLIC_APP_NAME=Internal Tools

# Which deployment this is: production | staging | development. Drives a
# non-production warning banner. Unset = production, so prod needs no extra
# config; set to "staging" on the staging/Preview deploy.
NEXT_PUBLIC_APP_ENV=

# Public web app URL. When set, admin mutations POST to
# `${NEXT_PUBLIC_WEB_URL}/api/revalidate` so the public cache refreshes.
NEXT_PUBLIC_WEB_URL=http://localhost:3000

# Admin dashboard URL. When set, the public site shows a "Manage" link.
NEXT_PUBLIC_ADMIN_URL=http://localhost:3001

# Public canonical site URL — used for absolute URLs (OpenGraph, sitemap).
NEXT_PUBLIC_SITE_URL=http://localhost:3000


# ── Cache revalidation ────────────────────────────────────────────────────
# Shared bearer secret the admin app uses to authenticate POSTs to the web
# app's /api/revalidate route. MUST be ≥ 16 chars and MUST match across both
# apps. Generate with `openssl rand -base64 32`. Optional — leave unset to
# skip cross-app cache invalidation (web caches just expire on their own).
REVALIDATE_SECRET=replace-with-shared-revalidation-secret


# ── Observability ─────────────────────────────────────────────────────────
# Sentry DSN. When unset, the instrumentation files no-op (no error reporting,
# zero runtime cost). Set per environment to enable @sentry/nextjs.
NEXT_PUBLIC_SENTRY_DSN=

# Pino log level for @repo/logger. One of: trace | debug | info | warn | error
# | fatal. Defaults to `info` in production, `debug` everywhere else.
LOG_LEVEL=


# ── Object storage (optional — @repo/storage / Cloudflare R2) ─────────────
# Only needed if your project stores files/images. R2 is S3-compatible; the
# same credentials work for any S3 endpoint. All five are validated as
# optional, so the apps build without them — call sites check presence at
# runtime (`isStorageConfigured()` / `requireR2Credentials()`).
R2_ACCOUNT_ID=
R2_ACCESS_KEY_ID=
R2_SECRET_ACCESS_KEY=
R2_BUCKET=
R2_PUBLIC_URL=
# Public base URL for served objects (used to build image URLs + the
# next.config image allow-list). NEXT_PUBLIC_* so it reaches the browser.
NEXT_PUBLIC_R2_PUBLIC_URL=


# ── Feature flags (@repo/env/features) ─────────────────────────────────────
# Server-only, deploy-time toggles. Off by default. Accepts: true | false |
# 1 | 0 | on | off. Adding a flag follows the same three-file rule as any env
# var: declare it in packages/env/src/features.ts, add it to turbo.json's
# build.env, and document it here.
#
# Example flag — replace with your project's real flags. Off → the gated
# surface is hidden from nav and unreachable by URL (see requireFeature).
BETA_FEATURES=


# ── CI / build ────────────────────────────────────────────────────────────
# Set to 1 in CI build steps to skip env validation (the Zod schemas would
# otherwise fail the build when secrets aren't injected at build time).
SKIP_ENV_VALIDATION=

# Guards the demo seed (`packages/db/src/seed/run.ts`) against running
# against a non-local database by accident — only localhost/Docker is allowed
# unless this is "true". `pnpm db:seed:staging` sets it automatically; you
# shouldn't need to set it by hand.
SEED_ALLOW_REMOTE=


# ── Stage files (.env.staging / .env.production) ───────────────────────────
# For the `db:*:staging` / `db:*:prod` commands (migrate, seed, studio), the
# Prisma CLI tooling reads root `.env.staging` / `.env.production` instead of
# `.env.local`. Create them the same way as `.env.local` — copy this file and
# fill in that stage's DATABASE_URL and secrets.
#
# Both files are gitignored (matched by the `.env.*` pattern) — NEVER commit
# them. Provide their contents locally when you need to run a stage command
# from your machine, or inject the same variables through your host
# platform's environment settings for deploys.