# Rerun, self-hosted. Copy to `.env`, fill the four lines marked REQUIRED, then run
#   node scripts/self-host-check.mjs
# which generates the secrets left empty and checks the rest before the first start.

# ---- The address people open in their browser -------------------------------------------------
# REQUIRED. Where the app is reached, without a trailing slash. Sign-in links point there.
NEXT_PUBLIC_APP_URL=http://localhost:3000
# The port docker compose publishes the app on, on this machine.
RERUN_APP_PORT=3000

# ---- Supabase (database, sign-in, storage, realtime) --------------------------------------------
# REQUIRED. A free project on supabase.com (Project settings > API), or the local stack started
# with `npx supabase start` (then http://localhost:54421 and the keys `supabase status` prints).
NEXT_PUBLIC_SUPABASE_URL=
# REQUIRED. The publishable key (anon key on older projects). Safe in the browser.
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=
# REQUIRED. The secret key (service_role on older projects). Never in the browser.
SUPABASE_SECRET_KEY=

# ---- The engine of your first workspace ---------------------------------------------------------
# Shared by the app and the engine started next to it. Generated by self-host-check.mjs.
RERUN_ENGINE_API_KEY=
# The port docker compose publishes that engine on, and the address a browser reaches it at, to
# watch a coworker's screen. Behind a domain, put its https address here.
RERUN_ENGINE_PORT=3001
RERUN_ENGINE_BROWSER_URL=http://localhost:3001

# ---- AI ----------------------------------------------------------------------------------------
# The onboarding guide and a few helpers (company research, naming, ideas) run on OpenRouter.
# Your coworkers use whatever you connect in the app instead: an Anthropic, OpenAI, Gemini or
# OpenRouter key, or your Claude or ChatGPT subscription. https://openrouter.ai/keys
OPENROUTER_API_KEY=
# Optional. Semantic search of the services catalog (keyword search works without it).
RERUN_EMBED_API_KEY=

# ---- Admins ------------------------------------------------------------------------------------
# Comma-separated emails that see the admin switches in the app. Manage the rest in Supabase Studio.
ADMIN_EMAILS=

# ---- Secrets, generated by self-host-check.mjs ---------------------------------------------------
# Signs the token the onboarding guide calls the app with.
FOREMAN_HUB_TOKEN_SECRET=
FOREMAN_HUB_TOKEN_REQUIRED=1
# Signs the board images the app captures for sharing.
BOARD_IMAGE_SECRET=

# ---- Sign-in -------------------------------------------------------------------------------------
# Comma-separated providers configured on your Supabase project (google, apple). Empty: email code.
NEXT_PUBLIC_OAUTH_PROVIDERS=
# Cloudflare Turnstile on sign-up. Set both or neither: a secret without the site key refuses every sign-up.
NEXT_PUBLIC_TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=
# hCaptcha puzzle, shown to a visitor Turnstile could not vouch for (or to everyone without Turnstile).
# Set both or neither, like Turnstile's.
NEXT_PUBLIC_HCAPTCHA_SITE_KEY=
HCAPTCHA_SECRET_KEY=

# ---- Optional services ---------------------------------------------------------------------------
# Composio connects 2,000+ apps by OAuth (https://composio.dev). Without it those connectors are off.
COMPOSIO_API_KEY=
# Web search for the coworkers (https://brave.com/search/api).
BRAVE_SEARCH_API_KEY=
# Reading websites (https://firecrawl.dev).
FIRECRAWL_API_KEY=
# LinkedIn and Google Maps research during onboarding (https://apify.com).
APIFY_TOKEN=
# Product analytics, off when empty (https://posthog.com).
NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=

# ---- Mobile app ----------------------------------------------------------------------------------
# The oldest build of the Rerun app, per store, that may still talk to this server: an older one is
# sent to the App Store or Google Play to update. Empty: every build is let through.
MOBILE_IOS_MIN_BUILD=
MOBILE_ANDROID_MIN_BUILD=