# Public app URL and local services
NEXT_PUBLIC_APP_URL=http://localhost:3002
DATABASE_URL=postgresql://keyword_pro:keyword_pro@localhost:5434/keyword_pro # pragma: allowlist secret
DATABASE_SSL_MODE=disable
REDIS_URL=redis://localhost:6381

# Generate with: openssl rand -base64 32
KEYWORD_PRO_ENCRYPTION_KEY=
# Optional alternative: absolute path to a file containing that key
KEYWORD_PRO_ENCRYPTION_KEY_FILE=
# Optional rotation keyring. Use this instead of the single key for new setups.
# Format: current:<base64-32B>,previous:<base64-32B>
KEYWORD_PRO_ENCRYPTION_KEYS=
KEYWORD_PRO_ENCRYPTION_KEY_ACTIVE=

# Compatibility fallback for old local ciphertext only. Leave disabled unless
# an existing installation previously used BETTER_AUTH_SECRET for encryption.
KEYWORD_PRO_ALLOW_AUTH_SECRET_ENCRYPTION_FALLBACK=false

# Local single-user profile
LOCAL_USER_EMAIL=local@example.com
LOCAL_USER_NAME="Local User"

# DataForSEO, or enter these later under Settings, Connections
DATAFORSEO_LOGIN=
DATAFORSEO_PASSWORD=

# Header-based credential overrides are disabled by default
RESEARCH_ALLOW_HEADER_BYOK=false