.env.prod.example

# Production .env template: copy to .env on the prod host and fill secrets.
# DO NOT reuse any values from .env.example or your dev .env.
# Generate fresh secrets for every environment:
#   openssl rand -base64 32              # for passwords
#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

# --- Database ---
DB_USER=article30
DB_PASSWORD=                # REQUIRED: openssl rand -base64 32
DATABASE_URL=postgresql://article30:CHANGEME@postgres:5432/article30

# --- Redis ---
REDIS_PASSWORD=             # REQUIRED: openssl rand -base64 32
REDIS_URL=redis://:CHANGEME@redis:6379

# --- Session / audit ---
SESSION_SECRET=             # REQUIRED: minimum 32 chars
AUDIT_HMAC_SECRET=          # REQUIRED: minimum 32 chars

# --- Runtime ---
NODE_ENV=production
COOKIE_SECURE=true          # true behind HTTPS

# --- Release version ---
# Pin a specific GHCR release tag. Default: latest.
# Use the SemVer tag from https://github.com/ipsec-dev/Article30/pkgs/container/article30%2Fbackend
# Examples: 1.2.3 (exact patch), 1.2 (latest patch of 1.2.x), 1 (latest of 1.x.x)
ARTICLE30_VERSION=

# --- Logging (defaults: info level, JSON output, HTTP access logs on) ---
LOG_LEVEL=info
LOG_PRETTY=false
LOG_HTTP=true

# --- S3 / object storage (RustFS in single-VPS deployments) ---
S3_ENDPOINT=http://rustfs:9000
S3_BUCKET=article30-documents
S3_ACCESS_KEY=              # REQUIRED: openssl rand -base64 18
S3_SECRET_KEY=              # REQUIRED: openssl rand -base64 32
S3_REGION=us-east-1

# --- HTTP origins ---
# Replace with your real public origin(s).
# For local prod-build smoke tests, use http://localhost:<port> and set
# COOKIE_SECURE=false above (HTTPS-only cookies won't be sent over http).
# Example (local prod build):
#   CORS_ORIGIN=http://localhost:3000
#   NEXT_PUBLIC_API_URL=http://localhost:3001
#   FRONTEND_URL=http://localhost:3000
CORS_ORIGIN=https://example.com
NEXT_PUBLIC_API_URL=https://example.com/api
FRONTEND_URL=https://example.com

# --- SMTP ---
# REQUIRED in production. Server refuses to start without SMTP_HOST/PORT/FROM.
# Set SMTP_ENABLED=false only if you accept that password reset emails will
# not be sent and admins must use the CLI to issue reset URLs.
SMTP_ENABLED=true
SMTP_HOST=                  # e.g. smtp.eu.mailgun.org
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=                  # e.g. no-reply@example.com

# Default email locale when Accept-Language is missing/unparseable (en | fr)
MAIL_DEFAULT_LOCALE=en