# ============================================================================
# osmRouter V2 — Production Environment
# ----------------------------------------------------------------------------
# Copy to `.env` and fill every «CHANGE».
# Generate the crypto bits with: ./scripts/generate-secrets.sh
# Mint the pinned-CA with:        ./scripts/init-ca.sh
# ============================================================================

# ----- 1. Domain & deployment surface ----------------------------------------
OSM_BRAND_DOMAIN=osmrouter.com
OSM_PROXY_CNAME=nodes.osmrouter.com
OSM_CORS_ORIGINS=https://osmrouter.com,https://app.osmrouter.com,https://www.osmrouter.com
OSM_COOKIE_DOMAIN=.osmrouter.com
OSM_NODE_ID=proxy-v2-01

# ----- 2. Cryptographic secrets (generate fresh!) ---------------------------
OSM_JWT_SECRET=«CHANGE»
OSM_OTP_MASTER_SECRET=«CHANGE»
OSM_CSRF_SECRET=«CHANGE»
OSM_AES_MASTER_KEY=«CHANGE»
OSM_PROXY_NODE_SECRET=«CHANGE»

# ----- 3. PostgreSQL --------------------------------------------------------
POSTGRES_HOST=postgres
POSTGRES_PORT=5432
POSTGRES_DB=osm
POSTGRES_USER=osm
POSTGRES_PASSWORD=«CHANGE»
OSM_DATABASE_URL=postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}?sslmode=require

# ----- 4. Redis -------------------------------------------------------------
REDIS_PASSWORD=«CHANGE»
OSM_REDIS_URL=redis://default:${REDIS_PASSWORD}@redis:6379

# ----- 5. Dashboard build-time --------------------------------------------
NEXT_PUBLIC_API_BASE=https://api.osmrouter.com

# Your edge IP — the public IPv4 customers point their A records at. This is
# rendered into the dashboard's DNS-instructions component so customers see
# the right value. The Docker build picks this up as a build-arg (see
# deploy/docker-compose.yml + deploy/Dockerfile.web).
NEXT_PUBLIC_OSM_EDGE_IP=«CHANGE»

# ----- 6. Email (REQUIRED for public signups) ------------------------------
SMTP_HOST=
SMTP_PORT=587
SMTP_USERNAME=
SMTP_PASSWORD=
SMTP_FROM=noreply@osmrouter.com

# ----- 7. Cloudflare-for-SaaS (optional) -----------------------------------
CLOUDFLARE_API_TOKEN=
CLOUDFLARE_ZONE_ID=

# ----- 8. Stripe (when monetised) ------------------------------------------
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=

# ----- 9. Observability ----------------------------------------------------
SENTRY_DSN=