# ---- required in production
DAILYTIMES_PUBLIC_URL=https://times.example.com
DAILYTIMES_SECRET=            # openssl rand -hex 32  (signs sessions; changing it signs everyone out)

# ---- database: Supabase (needed on Vercel), or SQLite file (default)
SUPABASE_URL=                 # https://<project>.supabase.co
SUPABASE_SERVICE_KEY=         # service_role / secret key: server only, never in a browser
# SUPABASE_SCHEMA=            # only if you put the tables outside `public`
DAILYTIMES_DB=dailytimes.db   # SQLite path when Supabase isn't set

# ---- sign-in email: Resend API key, or SMTP. Without either, links are only logged.
MAIL_FROM=Daily Times <times@example.com>
RESEND_API_KEY=
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=

# ---- optional
CRON_SECRET=                  # Vercel sends it to /cron/daily automatically
DAILYTIMES_ADMIN_TOKEN=       # allows `dailytimes register` (headless accounts without the website)
ANTHROPIC_API_KEY=            # lets Claude turn "what are you into?" into sources (otherwise keywords)
# DAILYTIMES_LLM_MODEL=claude-opus-5-5
DAILYTIMES_OPERATOR=          # shown in the footer and privacy page, e.g. "Jane Doe"
DAILYTIMES_CONTACT=           # privacy contact email
# Cookieless GA4 / PostHog on the signed-out pages. Empty = off (the default for self-hosting);
# times.flowsxr.com turns them on by its public URL.
# DAILYTIMES_GA_ID=G-XXXXXXXXXX
# DAILYTIMES_POSTHOG_KEY=phc_...
DAILYTIMES_INBOUND_DOMAIN=    # if you route brief+<token>@domain mail to /v1/inbound/email
DAILYTIMES_INBOUND_SECRET=
# DAILYTIMES_REPO_URL=https://github.com/<you>/dailytimes          # footer + privacy links (forks)
# DAILYTIMES_INSTALL_SPEC=dailytimes[escpos,mdns] @ git+https://github.com/<you>/dailytimes  # printer install command
# DAILYTIMES_DEV=1            # local only: shows sign-in links on screen when mail isn't configured