# ───────────────────────────────────────────────────────────────────
# Backend environment — copy to .env and fill in.
# ───────────────────────────────────────────────────────────────────

# Postgres (Neon recommended). Pooler URL works for runtime.
DATABASE_URL=postgresql://username:password@localhost:5432/scrolt

# Server
PORT=4000
NODE_ENV=development

# Upstash Redis (REST). Free tier is fine for dev.
UPSTASH_REDIS_REST_URL=https://your-redis-url.upstash.io
UPSTASH_REDIS_REST_TOKEN=your-redis-token


# Comma-separated allowed origins for CORS.
# Localhost dev origins are always allowed in NODE_ENV=development.
CORS_ORIGINS=https://scrolt.vercel.app

# Auth.js shared secret. MUST match frontend AUTH_SECRET.
# Generate with:  npx auth secret    (or: openssl rand -base64 32)
AUTH_SECRET=replace-me-with-a-32-byte-random-string

# ───────────────────────────────────────────────────────────────────
# Admin analytics dashboard (GET /admin)
# ───────────────────────────────────────────────────────────────────

# Password for the single-operator analytics dashboard. Min 20 chars.
# Generate with:  openssl rand -hex 24
#
# LEAVE THIS UNSET and /admin plus every /admin/api/* route returns 404,
# as though the dashboard doesn't exist. That's the safe default — a
# deploy that forgets this var exposes nothing.
# ADMIN_TOKEN=

# How long raw rows in analytics_events are kept before being pruned
# (default 120). Aggregate history is unaffected: retention and DAU also
# read user_progress, which is never pruned.
# ANALYTICS_RETENTION_DAYS=120