.env.example

# ═══════════════════════════════════════════════════════════════
# CONFAERO BACKEND - ENVIRONMENT CONFIGURATION
# ═══════════════════════════════════════════════════════════════
# NEVER commit .env file to version control
# ═══════════════════════════════════════════════════════════════

# ═══════════════════════════════════════════════════════════════
# SERVER CONFIGURATION
# ═══════════════════════════════════════════════════════════════
# Port number for the backend server
PORT=8081

# Backend server IP address (use 0.0.0.0 for all interfaces in production)
BACKEND_IP=10.10.11.30

# Node environment (development, staging, production)
NODE_ENV=development

# ═══════════════════════════════════════════════════════════════
# DATABASE CONFIGURATION (MongoDB Atlas)
# ═══════════════════════════════════════════════════════════════
# MongoDB connection string
# Format: mongodb+srv://<username>:<password>@<cluster>.mongodb.net/<database>?appName=<app>
# Steps to get this:
# 1. Create MongoDB Atlas account at https://www.mongodb.com/cloud/atlas
# 2. Create a cluster (free tier M0 available)
# 3. Create database user with read/write permissions
# 4. Whitelist your IP (0.0.0.0/0 for development)
# 5. Get connection string from "Connect" button
DB_URL=mongodb+srv://username:password@cluster.xxxxx.mongodb.net/confaero?appName=Cluster0

# ═══════════════════════════════════════════════════════════════
# JWT CONFIGURATION (Authentication)
# ═══════════════════════════════════════════════════════════════
# IMPORTANT: Use strong, random strings in production (min 32 characters)
# Generate secure secrets using: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

# Secret key for signing access tokens (short-lived, 2 hours)
ACCESS_TOKEN=your_super_secret_access_token_key_min_32_chars

# Secret key for signing refresh tokens (long-lived, 7 days)
REFRESH_TOKEN=your_super_secret_refresh_token_key_min_32_chars

# Access token expiration time
ACCESS_EXPIRES=2h

# Refresh token expiration time
REFRESH_EXPIRES=7d

# Secret key for password reset tokens
RESET_SECRET=your_password_reset_secret_key_min_32_chars

# Password reset token expiration (10 minutes recommended)
RESET_EXPIRES=10m

# Secret key for email verification tokens
VERIFIED_TOKEN=your_email_verification_token_secret_min_32_chars

# JWT signing secret (used for additional security)
JWT_ACCESS_SECRET=your_jwt_signing_secret_min_32_chars

# Frontend application URL (for CORS and redirect URLs)
FRONT_END_URL=http://localhost:3000

# ═══════════════════════════════════════════════════════════════
# QR CODE CONFIGURATION
# ═══════════════════════════════════════════════════════════════
# Secret key for QR code generation and validation
# Used for event check-in, lead generation, and attendee verification
# Must be at least 32 characters for security
QR_SECRET=your_qr_code_secret_key_min_32_chars

# ═══════════════════════════════════════════════════════════════
# EMAIL CONFIGURATION (SMTP via Nodemailer)
# ═══════════════════════════════════════════════════════════════
# Email address for sending system emails
# Used for: verification, password reset, invitations, notifications

# For Gmail:
# 1. Enable 2-Factor Authentication on your Google account
# 2. Generate an App Password: https://myaccount.google.com/apppasswords
# 3. Use the 16-character app password (no spaces)
APP_USER_EMAIL=your-email@gmail.com

# App-specific password (for Gmail) or SMTP password (for custom SMTP)
APP_PASSWORD=your-16-character-app-password

# For custom SMTP (uncomment and modify):
# APP_USER_EMAIL=smtp@yourdomain.com
# APP_PASSWORD=your-smtp-password

# ═══════════════════════════════════════════════════════════════
# CLOUDINARY CONFIGURATION (Optional - Image CDN)
# ═══════════════════════════════════════════════════════════════
# Alternative to AWS S3 for image storage and optimization
# Create account at https://cloudinary.com/
# Get credentials from Dashboard → Settings

# Cloudinary cloud name (from your dashboard)
CLOUD_NAME=your-cloudinary-cloud-name

# Cloudinary API key
CLOUD_API_KEY=your-cloudinary-api-key

# Cloudinary API secret (keep this secure!)
CLOUD_API_SECRET=your-cloudinary-api-secret

# ═══════════════════════════════════════════════════════════════
# SUPER ADMIN DEFAULT CREDENTIALS
# ═══════════════════════════════════════════════════════════════
# Initial super admin account (used in database seeding)
# Change these immediately after first deployment!

# Super admin email address
SUPER_ADMIN_EMAIL=superadmin@confareo.com

# Super admin password (use strong password in production!)
SUPER_ADMIN_PASSWORD=Super@Secure123!

# ═══════════════════════════════════════════════════════════════
# AWS S3 CONFIGURATION (File Storage)
# ═══════════════════════════════════════════════════════════════
# Used for: file uploads, chat attachments, poster PDFs, event banners
# Create S3 bucket in AWS Console: https://s3.console.aws.amazon.com/

# AWS Access Key ID (from IAM user with S3 permissions)
AWS_ACCESS_KEY_ID=AKIAXXXXXXXXXXXXXXXX

# AWS Secret Access Key (keep this secure!)
AWS_SECRET_ACCESS_KEY=your-aws-secret-access-key-40-chars

# S3 bucket name (must be globally unique)
AWS_BUCKET_NAME=your-bucket-name

# AWS region where bucket is located
AWS_REGION=eu-north-1

# Steps to set up AWS S3:
# 1. Create AWS account at https://aws.amazon.com/
# 2. Go to S3 Console and create a new bucket
# 3. Go to IAM → Users → Create user
# 4. Attach policy: AmazonS3FullAccess (or create custom policy)
# 5. Get Access Key ID and Secret Access Key from Security Credentials
# 6. Update values above

# ═══════════════════════════════════════════════════════════════
# ZEGOCLOUD CONFIGURATION (Live Streaming)
# ═══════════════════════════════════════════════════════════════
# Used for: live video sessions, hybrid events, online presentations
# Create account at https://console.zegocloud.com/

# ZegoCloud App ID (from your project dashboard)
ZEGOCLOUD_APP_ID=your-zegocloud-app-id

# ZegoCloud App Sign (from your project dashboard)
ZEGOCLOUD_APP_SIGN=your-zegocloud-app-sign

# ZegoCloud Server Secret (for server-side token generation)
ZEGOCLOUD_SERVER_SECRET=your-zegocloud-server-secret

# Steps to set up ZegoCloud:
# 1. Create ZegoCloud account
# 2. Create a new project (select "Live Streaming" scenario)
# 3. Get App ID and App Sign from Project Management
# 4. Enable "Server Token Verification" in Security Settings
# 5. Generate Server Secret

# ═══════════════════════════════════════════════════════════════
# STRIPE CONFIGURATION (Payment Processing)
# ═══════════════════════════════════════════════════════════════
# Used for: ticket sales, booth payments, exhibitor registration
# Create account at https://stripe.com/

# Stripe Secret Key (from Developers → API keys)
# Test keys start with sk_test_, Production keys start with sk_live_
STRIPE_SECRET_KEY=sk_test_your_stripe_secret_key

# Stripe Webhook Secret (for payment notifications)
# Get this by:
# 1. Go to Developers → Webhooks in Stripe Dashboard
# 2. Add endpoint: https://your-domain.com/webhooks/stripe
# 3. Select events: payment_intent.succeeded, payment_intent.failed
# 4. Copy the Signing Secret
STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret

# For Stripe Connect (organizer payouts):
# 1. Enable Stripe Connect in Dashboard
# 2. Configure OAuth redirect URI
# 3. Get Client ID (add to .env if using Connect)
# STRIPE_CLIENT_ID=ca_xxxxxxxxxxxxxx

# ═══════════════════════════════════════════════════════════════
# GOOGLE MAPS API CONFIGURATION
# ═══════════════════════════════════════════════════════════════
# Used for: event location display, venue maps, geocoding
# Enable APIs in Google Cloud Console: https://console.cloud.google.com/

# Google Maps API Key
# Required APIs: Maps JavaScript API, Geocoding API, Places API
GOOGLE_MAPS_API_KEY=your-google-maps-api-key

# Steps to get Google Maps API Key:
# 1. Create Google Cloud account
# 2. Create a new project
# 3. Enable required APIs (Maps JavaScript, Geocoding)
# 4. Go to APIs & Services → Credentials
# 5. Create Credentials → API Key
# 6. Restrict key to your domain (recommended for production)

# ═══════════════════════════════════════════════════════════════
# ADDITIONAL CONFIGURATION (Optional)
# ═══════════════════════════════════════════════════════════════

# Firebase Admin SDK (server — verifies idToken)
FIREBASE_SERVICE_ACCOUNT_PATH=secrets/firebase-admin.json
FIREBASE_PROJECT_ID=your-project-id
FIREBASE_CLIENT_EMAIL=firebase-adminsdk-xxxxx@your-project-id.iam.gserviceaccount.com
# Required if secrets/firebase-admin.json is not on this host (e.g. deployed server)
FIREBASE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"

# Optional: entire service account JSON as one line (alternative to file + private key)
# FIREBASE_SERVICE_ACCOUNT_JSON={"type":"service_account","project_id":"..."}

# Firebase Web app (client — from Firebase Console → Project settings → Your apps)
FIREBASE_WEB_API_KEY=your-web-api-key
FIREBASE_AUTH_DOMAIN=your-project-id.firebaseapp.com
FIREBASE_STORAGE_BUCKET=your-project-id.firebasestorage.app
FIREBASE_MESSAGING_SENDER_ID=123456789
FIREBASE_APP_ID=1:123456789:web:abcdef
FIREBASE_MEASUREMENT_ID=G-XXXXXXXX

# Rate Limiting (for production)
# RATE_LIMIT_WINDOW_MS=900000
# RATE_LIMIT_MAX_REQUESTS=100

# Logging Configuration
# LOG_LEVEL=info
# LOG_FILE_PATH=./logs/app.log

# Redis Configuration (for caching - recommended for production)
# REDIS_HOST=localhost
# REDIS_PORT=6379
# REDIS_PASSWORD=your-redis-password

# Session Configuration
# SESSION_SECRET=your-session-secret-key

# CORS Configuration (add more origins as needed)
# CORS_ORIGINS=http://localhost:3000,https://yourdomain.com

# File Upload Limits (in bytes)
# MAX_FILE_SIZE=104857600
# MAX_FILES_PER_UPLOAD=10

# Email Rate Limiting
# EMAIL_RATE_LIMIT_PER_HOUR=100

# SMS Configuration (Twilio - if adding SMS verification)
# TWILIO_ACCOUNT_SID=your-twilio-sid
# TWILIO_AUTH_TOKEN=your-twilio-token
# TWILIO_PHONE_NUMBER=+1234567890

# Analytics Configuration
# GOOGLE_ANALYTICS_ID=UA-XXXXXXXXX-X
# SENTRY_DSN=https://your-sentry-dsn

# ═══════════════════════════════════════════════════════════════
# SECURITY NOTES
# ═══════════════════════════════════════════════════════════════
# 1. NEVER commit .env file to version control (it's in .gitignore)
# 2. Use different secrets for development and production
# 3. Rotate secrets regularly (every 90 days recommended)
# 4. Use environment variable management in production (AWS Secrets Manager, etc.)
# 5. Enable HTTPS in production
# 6. Use strong passwords (min 12 characters, mix of upper/lower/numbers/symbols)
# 7. Restrict API keys to specific domains/IPs
# 8. Monitor API usage for unusual activity

# ═══════════════════════════════════════════════════════════════
# SETUP CHECKLIST
# ═══════════════════════════════════════════════════════════════
# Before running the application, ensure you have:
# [ ] Created MongoDB Atlas cluster and got connection string
# [ ] Generated all JWT secrets (use crypto.randomBytes)
# [ ] Set up AWS S3 bucket and IAM user
# [ ] Created Stripe account and got API keys
# [ ] Set up ZegoCloud project for live streaming
# [ ] Configured email SMTP credentials
# [ ] Got Google Maps API key
# [ ] Changed default super admin password
# [ ] Set NODE_ENV to production (for production deployment)
# [ ] Configured CORS with specific origins

# ═══════════════════════════════════════════════════════════════
# TROUBLESHOOTING
# ═══════════════════════════════════════════════════════════════
# Common issues and solutions:

# MongoDB Connection Failed:
# - Check connection string format
# - Verify IP whitelist in MongoDB Atlas
# - Ensure database user has correct permissions

# Email Not Sending:
# - For Gmail, ensure App Password is used (not regular password)
# - Check if 2FA is enabled on Google account
# - Verify SMTP credentials for custom SMTP

# S3 Upload Failed:
# - Verify IAM user has S3 permissions
# - Check bucket name and region
# - Ensure bucket policy allows uploads

# Stripe Webhook Failed:
# - Verify webhook secret format (starts with whsec_)
# - Check webhook endpoint is publicly accessible
# - Use Stripe CLI for local testing

# For more help, see the README.md or API_DOCUMENTATION.md