# ============================================================
# DevFolio — Environment Variables
# Copy this file to .env and fill in real values.
# Never commit .env to version control.
# ============================================================

# ── App ──────────────────────────────────────────────────────
NODE_ENV=development
PORT=3001

# ── Database ─────────────────────────────────────────────────
DATABASE_URL=postgresql://devfolio:devfolio@localhost:5432/devfolio
# Set to true when connecting to a managed PostgreSQL that requires SSL (e.g. Supabase, RDS)
DATABASE_SSL=false

# ── Redis ────────────────────────────────────────────────────
REDIS_URL=redis://localhost:6379
REDIS_HOST=localhost
REDIS_PORT=6379

# ── JWT ──────────────────────────────────────────────────────
# Generate with: node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"
JWT_SECRET=CHANGE_ME_64_CHAR_HEX_SECRET
JWT_EXPIRES_IN=7d
JWT_REFRESH_SECRET=CHANGE_ME_DIFFERENT_64_CHAR_HEX_SECRET
JWT_REFRESH_EXPIRES_IN=30d

# ── Analytics ─────────────────────────────────────────────────
# Salt for one-way IP hashing (required in production).
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
IP_HASH_SALT=CHANGE_ME_32_CHAR_HEX_SALT

# ── Encryption ────────────────────────────────────────────────
# AES-256-GCM key for encrypting sensitive values at rest (GitHub tokens, etc.)
# Required in production. Must be exactly 64 hex characters (32 bytes).
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
ENCRYPTION_KEY=CHANGE_ME_64_CHAR_HEX_KEY

# ── GitHub OAuth ──────────────────────────────────────────────
# Create at: https://github.com/settings/developers → New OAuth App
# Homepage URL:     http://localhost:3000
# Callback URL:     http://localhost:3001/api/v1/auth/github/callback
GITHUB_CLIENT_ID=CHANGE_ME
GITHUB_CLIENT_SECRET=CHANGE_ME
GITHUB_CALLBACK_URL=http://localhost:3001/api/v1/auth/github/callback

# ── Google OAuth ───────────────────────────────────────────────
# Create at: https://console.cloud.google.com → APIs & Services → Credentials
# Authorized redirect URI: http://localhost:3001/api/v1/auth/google/callback
GOOGLE_CLIENT_ID=CHANGE_ME
GOOGLE_CLIENT_SECRET=CHANGE_ME
GOOGLE_CALLBACK_URL=http://localhost:3001/api/v1/auth/google/callback

# ── Storage ───────────────────────────────────────────────────
STORAGE_PROVIDER=local
STORAGE_LOCAL_PATH=./uploads
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_S3_BUCKET=
AWS_REGION=us-east-1

# ── Email (Resend) ────────────────────────────────────────────
# Sign up at: https://resend.com — free tier is 100 emails/day
RESEND_API_KEY=CHANGE_ME
NOTIFICATION_FROM_EMAIL=noreply@yourdomain.com
NOTIFICATION_EMAIL_ENABLED=true

# ── AI Writing ────────────────────────────────────────────────
# Powers Improve Writing / Grammar Check / Shorter on resume fields and
# portfolio bios. Self-hosted via the `ollama` Docker service by default —
# free, private, no API key, no usage limits. Needs ~2GB RAM free.
AI_PROVIDER=ollama
OLLAMA_URL=http://ollama:11434
OLLAMA_MODEL=llama3.2:3b

# Set AI_PROVIDER=openrouter to use a cloud model instead (useful if your
# server can't spare the RAM/CPU for local inference). Uses OpenRouter's
# free-tier models — no credits needed, just an account.
# OPENROUTER_API_KEY=sk-or-CHANGE_ME
# OPENROUTER_MODEL=meta-llama/llama-3.3-70b-instruct:free
# OPENROUTER_URL=https://openrouter.ai/api/v1/chat/completions

# ── Frontend ──────────────────────────────────────────────────
NEXT_PUBLIC_API_URL=http://localhost:3001
NEXT_PUBLIC_APP_URL=http://localhost:3000

# ── Custom domains (all optional — sensible defaults in code) ──
# The host DevFolio's own app is served on. Used by the API to reject it as a
# "custom" domain, and by the web middleware to decide which Host headers are
# custom domains to route. Set both to your real production host.
APP_PRIMARY_HOST=devfolioapp.cloud
NEXT_PUBLIC_PRIMARY_HOST=devfolioapp.cloud
# CNAME target shown to users when they add a custom domain. Defaults to
# APP_PRIMARY_HOST if unset.
CUSTOM_DOMAIN_TARGET=devfolioapp.cloud
# Base URL the web container uses for server-side (SSR) calls to the API. In
# Docker the API is the `api` service, not localhost. Defaults to http://api:3001.
INTERNAL_API_URL=http://api:3001
# Email used for the Let's Encrypt ACME account (cert expiry notices). Used by
# the bundled Caddy edge that terminates TLS for the primary host and issues
# on-demand certificates for verified custom domains.
ACME_EMAIL=admin@devfolioapp.cloud