# spawn-server
SPAWN_DATABASE_URL=postgresql+asyncpg://spawn:spawn@localhost:5432/spawn
SPAWN_REDIS_URL=redis://localhost:6379/0

# JWT signing key (generate with: python -c 'import secrets; print(secrets.token_urlsafe(64))')
SPAWN_JWT_SECRET=change-me-in-prod-please-this-is-only-for-local

# Public-facing URL the daemon and browser will hit
SPAWN_PUBLIC_URL=http://localhost:8000

# Direct browser-to-daemon terminal transport. STUN-only is best-effort across
# restrictive NATs; add TURN for reliable off-LAN/mobile/corporate networks.
SPAWN_WEBRTC_ENABLED=true
SPAWN_WEBRTC_ICE_SERVERS=[{"urls":["stun:stun.l.google.com:19302"]}]

# Optional human sign-in providers. Buttons appear only when both values for a
# provider are set. Register each app with:
#   http://localhost:8000/api/auth/oauth/<provider>/callback
SPAWN_GOOGLE_CLIENT_ID=
SPAWN_GOOGLE_CLIENT_SECRET=
SPAWN_MICROSOFT_CLIENT_ID=
SPAWN_MICROSOFT_CLIENT_SECRET=
SPAWN_GITHUB_CLIENT_ID=
SPAWN_GITHUB_CLIENT_SECRET=

# Comma-separated browser origins allowed to call the API with credentials
SPAWN_CORS_ORIGINS=http://localhost:3000

# Notifications for a browser that is closed (Web Push / VAPID). Empty means
# no browser channel, which is the normal state in development — phones are
# unaffected. See docs/PUSH.md to generate the key pair. Never commit it.
SPAWN_VAPID_PRIVATE_KEY=
SPAWN_VAPID_SUBJECT=

# Web app
NEXT_PUBLIC_SPAWN_API_URL=http://localhost:8000
NEXT_PUBLIC_SPAWN_WS_URL=ws://localhost:8000