-
Notifications
You must be signed in to change notification settings - Fork 4
Expand file tree
/
Copy path.env.example
More file actions
119 lines (101 loc) · 6.33 KB
/
Copy path.env.example
File metadata and controls
119 lines (101 loc) · 6.33 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# Parent: REQ-0019
# Copy this file to `.env` for local development. Never commit `.env` or real
# credentials. Variables marked REQUIRED are needed for their feature; OPTIONAL
# variables may be left empty. `NEXT_PUBLIC_*` values are shipped to browsers.
# Application URLs ---------------------------------------------------------------
# REQUIRED. Public origin used by browser API calls; URL with protocol, no path.
# Local: http://localhost:3000. Production: your deployed HTTPS origin.
NEXT_PUBLIC_API_ENDPOINT="http://localhost:3000"
NEXT_PUBLIC_PROD_API_ENDPOINT="https://library.example.com"
# REQUIRED locally by Auth.js. Must match the local application origin.
NEXTAUTH_URL="http://localhost:3000"
# Authentication -----------------------------------------------------------------
# REQUIRED. Server-only random secret. Generate one with either command:
# npx auth secret
# openssl rand -base64 32
# Auth.js deployment guide: https://authjs.dev/getting-started/deployment
AUTH_SECRET="replace-with-a-random-32-byte-secret"
# OPTIONAL. Set true only when the application runs behind a trusted reverse
# proxy (including a controlled production platform) whose Host headers are
# validated. Keep false for direct local access and make NEXTAUTH_URL exact.
AUTH_TRUST_HOST="false"
# REQUIRED only for irreversible admin book deletion. Server-only and distinct
# from AUTH_SECRET. Generate with: openssl rand -base64 32
ADMIN_DELETE_SECRET="replace-with-a-different-random-secret"
# OPTIONAL. Required only when Google OAuth is enabled in `auth.ts`.
# Create OAuth 2.0 web credentials in Google Cloud Console:
# https://console.cloud.google.com/apis/credentials
GOOGLE_CLIENT_ID=""
GOOGLE_CLIENT_SECRET=""
# PostgreSQL ----------------------------------------------------------------------
# REQUIRED. Server-only PostgreSQL connection URI:
# postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=require
# Copy it from the Connect/Connection details page of your PostgreSQL provider,
# or create a local database and supply its URI.
DATABASE_URL="postgresql://USER:PASSWORD@HOST:5432/DATABASE?sslmode=require"
# OPTIONAL, tests only. Must target a disposable PostgreSQL database because the
# REQ-0025 integration suite creates/truncates its verification tables. Create
# one locally with `createdb university_library_test`; never use production data.
TEST_DATABASE_URL="postgresql://USER:PASSWORD@localhost:5432/DISPOSABLE_TEST_DATABASE"
# ImageKit ------------------------------------------------------------------------
# REQUIRED for media upload/display. In ImageKit Dashboard, open Developer
# options / API keys: https://imagekit.io/dashboard/developer/api-keys
# The URL endpoint is also shown in the dashboard. Only the private key is secret.
# Docs: https://imagekit.io/docs/api-keys
NEXT_PUBLIC_IMAGEKIT_PUBLIC_KEY="public_example_key"
NEXT_PUBLIC_IMAGEKIT_URL_ENDPOINT="https://ik.imagekit.io/your_imagekit_id"
IMAGEKIT_PRIVATE_KEY="private_example_key"
# Upstash Redis -------------------------------------------------------------------
# REQUIRED for application rate limiting. Create/open a Redis database in
# https://console.upstash.com/redis and copy its REST URL and REST token.
# Docs: https://upstash.com/docs/redis/overall/getstarted
UPSTASH_REDIS_REST_URL="https://example-redis.upstash.io"
UPSTASH_REDIS_REST_TOKEN="replace-with-upstash-redis-rest-token"
# OPTIONAL compatibility aliases read by `lib/config.ts`. Use the same REST
# endpoint/token only if code importing that central config is enabled.
UPSTASH_REDIS_URL=""
UPSTASH_REDIS_TOKEN=""
# Upstash QStash / Workflow -------------------------------------------------------
# REQUIRED only when ENABLE_WORKFLOWS="true". Open https://console.upstash.com/qstash
# and copy the request URL and token. For local QStash development, use the values
# printed by its development server:
# https://upstash.com/docs/qstash/howto/local-development
QSTASH_URL="https://qstash.upstash.io/v2"
QSTASH_TOKEN="replace-with-qstash-token"
# OPTIONAL feature flag. Keep false unless QStash is configured and reachable.
ENABLE_WORKFLOWS="false"
# Email ---------------------------------------------------------------------------
# At least one provider is REQUIRED for email delivery; configuring both enables
# Brevo-primary/Resend-fallback behavior.
# Brevo: create an API key at https://app.brevo.com/settings/keys/api and verify
# the sender address in the Brevo console. The sender name is display text.
BREVO_API_KEY="replace-with-brevo-api-key"
BREVO_SENDER_EMAIL="verified-sender@example.com"
BREVO_SENDER_NAME="BookWise Library"
# Resend: create a key at https://resend.com/api-keys and verify the sending
# domain/address in https://resend.com/domains. Server-only.
RESEND_TOKEN="replace-with-resend-api-key"
RESEND_SENDER_EMAIL="BookWise Library <library@verified-domain.example>"
# Reservation outbox -------------------------------------------------------------
# REQUIRED in production. Vercel Cron sends this value as a Bearer token to the
# recovery worker. Keep it server-only and distinct from every other secret.
# Generate a 64-character Base64 token with: openssl rand -base64 48
CRON_SECRET="replace-with-a-different-random-secret"
# Sentry (error monitoring) -------------------------------------------------------
# OPTIONAL locally; REQUIRED for production error/trace telemetry (REQ-0032).
# Create a project at https://sentry.io/ — Client Keys (DSN) + Auth Tokens for
# source-map upload. Browser events tunnel via same-origin `/api/monitoring`
# (withSentryConfig tunnelRoute) so ad blockers do not block ingest hosts.
# Set the same keys on Vercel Production/Preview. Never commit real tokens.
# Docs: https://docs.sentry.io/platforms/javascript/guides/nextjs/
NEXT_PUBLIC_SENTRY_DSN="https://PUBLIC_KEY@oORG_ID.ingest.sentry.io/PROJECT_ID"
# OPTIONAL server alias; may match NEXT_PUBLIC_SENTRY_DSN.
SENTRY_DSN="https://PUBLIC_KEY@oORG_ID.ingest.sentry.io/PROJECT_ID"
SENTRY_ORG="your-org-slug"
SENTRY_PROJECT="your-project-slug"
# Server-only. Source maps / CI upload. Rotate if ever exposed in chat or logs.
SENTRY_AUTH_TOKEN="replace-with-sentry-auth-token"
# Platform-managed variables ------------------------------------------------------
# Do not add assignments for NODE_ENV, VERCEL, or VERCEL_URL. Node.js/Next.js and
# Vercel inject them automatically. The application reads them only to choose
# development behavior and derive deployed origins.