# Build-time environment and canonical HTTPS origin.
APP_ENV=local
APP_ORIGIN=https://www.chumrush.localhost

# Mapbox public token (pk.*), never a secret token (sk.*).
# Allow https://www.chumrush.localhost/* in this token's URL restrictions.
PUBLIC_MAPBOX_ACCESS_TOKEN=

# Create a dedicated API application at https://www.strava.com/settings/api.
# Authorization Callback Domain: www.chumrush.localhost (no scheme or path).
# The callback URL is derived from APP_ORIGIN.
STRAVA_CLIENT_ID=
STRAVA_CLIENT_SECRET=

# Private session-encryption key. Generate once with: openssl rand -hex 32
# Keep this stable across restarts and do not reuse it in hosted environments.
AUTH_SECRET=

# Local services started by npm run dev:services.
# Dedicated local credentials; these are not real AWS credentials.
DYNAMODB_ENDPOINT=http://127.0.0.1:8100
DYNAMODB_REGION=us-east-1
DYNAMODB_ACCESS_KEY_ID=local
DYNAMODB_SECRET_ACCESS_KEY=local
# Created automatically in DynamoDB Local on the first login.
DYNAMODB_PROFILES_TABLE=chumrush-profiles

# Mailpit captures outgoing development email. No SMTP authentication or TLS.
SMTP_HOST=127.0.0.1
SMTP_PORT=1125