# =============================================================================
# Environment Variables
# Copy this file to .env and fill in your values
# =============================================================================

# -----------------------------------------------------------------------------
# Site Configuration
# -----------------------------------------------------------------------------
SITE_URL=https://example.com
NEXT_PUBLIC_SITE_URL=https://example.com

# -----------------------------------------------------------------------------
# Database (PostgreSQL)
# Local:   postgresql://username@localhost:5432/buildbase
# Docker:  Set via docker-compose.yml (uses POSTGRES_* vars below)
# Remote:  postgresql://user:password@host:5432/database?sslmode=require
# -----------------------------------------------------------------------------
DATABASE_URL=postgresql://username@localhost:5432/buildbase

# -----------------------------------------------------------------------------
# Security
# Must be at least 32 characters for JWT signing
# Generate with: openssl rand -base64 32
# -----------------------------------------------------------------------------
SYSTEM_SECRET=your-super-secret-key-at-least-32-chars

# -----------------------------------------------------------------------------
# BuildBase SDK
# Get these from your BuildBase dashboard
# -----------------------------------------------------------------------------
NEXT_PUBLIC_BUILDBASE_SERVER_URL=https://api.console.buildbase.app
NEXT_PUBLIC_BUILDBASE_ORG_ID=your-org-id
NEXT_PUBLIC_BUILDBASE_CLIENT_ID=your-client-id
NEXT_PUBLIC_BUILDBASE_REDIRECT_URL=http://localhost:3000
BUILDBASE_CLIENT_SECRET=your-client-secret

# Webhooks (optional — /api/webhooks/buildbase)
# Register <site>/api/webhooks/buildbase under Settings → Webhooks in the
# console and paste the endpoint's signing secret here. Without it the route
# answers 503 and every delivery is dropped.
# BUILDBASE_WEBHOOK_SECRET=whsec_xxx
# Content webhooks (/api/webhooks/content) refresh the help pages when content
# changes in the console. Defaults to BUILDBASE_WEBHOOK_SECRET when unset.
# BUILDBASE_CONTENT_WEBHOOK_SECRET=whsec_xxx

# OAuth2 integration (optional — for /api/auth/oauth2-token and /api/auth/oauth2-profile)
# Use the clientSecret from your OAuth2 auth settings if different from the main client secret
# BUILDBASE_OAUTH2_CLIENT_ID=your-oauth2-client-id
# BUILDBASE_OAUTH2_CLIENT_SECRET=your-oauth2-client-secret

# -----------------------------------------------------------------------------
# Docker (only needed for docker-compose)
# Used by docker-compose.yml to configure the PostgreSQL container
# -----------------------------------------------------------------------------
# POSTGRES_USER=postgres
# POSTGRES_PASSWORD=change-me-to-a-secure-password
# POSTGRES_DB=buildbase

# -----------------------------------------------------------------------------
# Sentry Error Monitoring (optional)
# Get these from your Sentry project settings
# https://sentry.io → Project Settings → Client Keys (DSN)
# Leave empty to disable Sentry
# -----------------------------------------------------------------------------
# NEXT_PUBLIC_SENTRY_DSN=https://xxxxx@o123456.ingest.sentry.io/123456
# SENTRY_ORG=your-sentry-org
# SENTRY_PROJECT=your-sentry-project

# Auth token for source map uploads (optional, for production builds)
# Create at: https://sentry.io/settings/auth-tokens/
# SENTRY_AUTH_TOKEN=sntrys_xxxxx

# -----------------------------------------------------------------------------
# Optional: Skip env validation during CI/CD or testing
# -----------------------------------------------------------------------------
# SKIP_ENV_VALIDATION=true

# Organization API token (console -> Settings -> API tokens), sent as `Authorization: Bearer <orgId>:<secret>` for org-level calls the session cannot make.
BUILDBASE_API_TOKEN=