# General URLs
KANEO_CLIENT_URL=http://localhost:5173
# KANEO_API_URL=http://localhost:1337      # optional - defaults to KANEO_CLIENT_URL/api
# CORS_ORIGINS=                            # optional - comma-separated; defaults to KANEO_CLIENT_URL

# Database
# DATABASE_URL=                            # optional: use this for host-native or external DB access
POSTGRES_DB=kaneo
POSTGRES_USER=kaneo
POSTGRES_PASSWORD=
# POSTGRES_HOST=postgres                   # Compose container default; use localhost for host-native API startup
# POSTGRES_PORT=5432
# Note: POSTGRES_DB and POSTGRES_USER alone do not enable derived connection mode.
# Derived DATABASE_URL is only used when POSTGRES_PASSWORD or an explicit host/port is set.

# Redis Pub/Sub for WebSockets (Optional) -> auto fallback to in memory
# Only one mode should be configured. Priority: Cluster > Sentinel > Standalone.

# Standalone
#REDIS_URL=

# Sentinel
#REDIS_SENTINELS=
#REDIS_SENTINEL_MASTER_NAME=mymaster
#REDIS_SENTINEL_PASSWORD=
#REDIS_SENTINEL_TLS=false

# Cluster
#REDIS_CLUSTER_NODES=

# Shared (Sentinel & Cluster)
#REDIS_PASSWORD=

# Authentication
# Generate with: openssl rand -hex 32
# If unset, a random secret is generated at startup (sessions won't survive restarts)
AUTH_SECRET=

# GitHub SSO (Sign in with GitHub, OAuth App)
GITHUB_OAUTH_CLIENT_ID=
GITHUB_OAUTH_CLIENT_SECRET=
# Legacy fallback for SSO (used only if GITHUB_OAUTH_* are unset)
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# GitHub integration (GitHub App: repository sync, webhooks)
GITHUB_APP_ID=
GITHUB_WEBHOOK_SECRET=
GITHUB_PRIVATE_KEY=
GITHUB_APP_NAME=

# SMTP Configuration
SMTP_HOST=
SMTP_PORT=
SMTP_SECURE=
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=
SMTP_REQUIRE_TLS=
# When SMTP is configured, sign-in uses email verification codes by default.
# Set to true to use email/password sign-in instead (invitations still use SMTP).
#DISABLE_EMAIL_OTP_SIGN_IN=false

# Cloud-mode abuse mitigations (only enable on hosted multi-tenant instances).
# When KANEO_CLOUD=true: signup with disposable-email providers is blocked,
# Turnstile is required on /sign-up/email, guest accounts cannot send
# workspace invites, and per-IP rate limits apply to signup + invite paths.
#KANEO_CLOUD=false

# Cloudflare Turnstile (signup captcha). Set the secret key to enforce;
# leave unset to skip verification (self-hosted).
#TURNSTILE_SECRET_KEY=
# Web container: the production image bakes "KANEO_TURNSTILE_SITE_KEY" as a
# placeholder and apps/web/env.sh substitutes it at container start from this
# env var. For local dev (vite), set VITE_TURNSTILE_SITE_KEY in apps/web/.env.
#KANEO_TURNSTILE_SITE_KEY=

# Sentry error tracking (Optional): errors are only reported when a DSN is set
# SENTRY_DSN=
# SENTRY_ENVIRONMENT=production

# Kaneo Cloud billing via Creem (Optional): only active when KANEO_CLOUD=true
# and both keys are set. Self-hosted installs leave these empty; billing stays off.
# CREEM_API_KEY=
# CREEM_WEBHOOK_SECRET=
# CREEM_TEST_MODE=true                     # use Creem's sandbox API
# CREEM_PRODUCT_PERSONAL_MONTHLY=
# CREEM_PRODUCT_PERSONAL_ANNUAL=
# CREEM_PRODUCT_TEAM_MONTHLY=
# CREEM_PRODUCT_TEAM_ANNUAL=
# BILLING_TRIAL_DAYS=14
# BILLING_FOUNDING_CUTOFF=                 # ISO date; workspaces created on/before keep free access