# Dokploy API
DOKPLOY_DOMAIN=dokploy.example.com
DOKPLOY_API_KEY=
DOKPLOY_ENVIRONMENT_ID=
DOKPLOY_COMPOSE_NAME=hostr-app

# Public domains
ROOT_DOMAIN=example.com
# Defaults to ROOT_DOMAIN when generated by the installer/CLI.
APP_DOMAIN=example.com
LOGTO_DOMAIN=auth.example.com
LOGTO_ADMIN_DOMAIN=auth-admin.example.com
UMAMI_DOMAIN=umami.example.com
USESEND_DOMAIN=mail.example.com

# App image
#
# CI/CD path (recommended): GitHub Actions builds and pushes to GHCR.
#   APP_IMAGE=ghcr.io/<owner>/<repo>/app:latest
#   APP_PULL_POLICY=always
#   APP_BUILD_CONTEXT=   (leave empty — CI builds the image)
#   GitHub secrets required: DOKPLOY_DOMAIN, DOKPLOY_API_KEY,
#     DOKPLOY_ENVIRONMENT_ID, DOKPLOY_COMPOSE_NAME
#
# VPS iteration path: run bin/hostr-stack deploy on the server itself.
#   APP_IMAGE=hostr-nextjs-starter:local
#   APP_PULL_POLICY=never
#   APP_BUILD_CONTEXT=./apps/nextjs-starter
#
HOSTR_STACK_ROOT=.
APP_IMAGE=hostr-nextjs-starter:latest
APP_PULL_POLICY=never
APP_BUILD_CONTEXT=./apps/nextjs-starter
APP_DOCKERFILE=Dockerfile

# Main app database
#
# postgres keeps the app on the shared core Postgres service.
# mongodb also starts a MongoDB service in hostr-data for the app.
# convex treats Convex as an external app backend; set CONVEX_URL.
#
# Postgres is always deployed for Dokploy, Logto, Umami, and stack metadata.
MAIN_APP_DB=postgres
MONGODB_PASSWORD=
CONVEX_URL=
CONVEX_DEPLOYMENT=
CONVEX_DEPLOY_KEY=
CONVEX_DOMAIN=
CONVEX_SITE_DOMAIN=
CONVEX_DASHBOARD_DOMAIN=
CONVEX_INSTANCE_SECRET=

# Generated by bin/hostr-stack init if empty
POSTGRES_PASSWORD=
UMAMI_APP_SECRET=
LOGTO_COOKIE_SECRET=
USESEND_NEXTAUTH_SECRET=
MINIO_ROOT_PASSWORD=

# Fill after creating a Logto traditional web app in Logto Console
LOGTO_APP_ID=
LOGTO_APP_SECRET=

# Optional third-party credentials for useSend
USESEND_GITHUB_ID=replace-with-github-client-id
USESEND_GITHUB_SECRET=replace-with-github-client-secret
USESEND_API_KEY=
USESEND_SMTP_CERT_DIR=/opt/hostr-stack/usesend-smtp-certs
AWS_DEFAULT_REGION=us-east-1
AWS_ACCESS_KEY=usesend-local
AWS_SECRET_KEY=usesend-local