example.env

# Deployment environment reference — NO real values here.
# These are the ONLY places secrets may live (env or secret file). They are
# never logged, audited, or returned by Panel APIs.

# PostgreSQL
PPB_DATABASE_URL=postgres://ppb:CHANGE_ME@127.0.0.1:5432/ppb

# JWT signing secret (>= 32 random bytes, base64)
PPB_JWT_SECRET=CHANGE_ME_base64_random_32_bytes

# AES-256-GCM key for encrypting Phira refresh tokens (32 random bytes, base64)
PPB_PHIRA_CREDENTIAL_KEY=CHANGE_ME_base64_random_32_bytes

# GitHub OAuth (client id may also be placed here)
PPB_GITHUB_CLIENT_ID=
PPB_GITHUB_CLIENT_SECRET=

# OpenUDS token mode (optional; if empty -> approve mode)
PPB_PMP_OPENUDS_TOKEN=

# Web Push VAPID — env names match config keys
# `vapid_private_key_pem` / `vapid_subject` (config/mod.rs NotificationConfig).
# Env wins over ppb.toml [notifications]; the PEM is a secret — keep 0600.
PPB_VAPID_PRIVATE_KEY_PEM=
PPB_VAPID_SUBJECT=

# Android / Windows push — production credentials remain a Release Gate
PPB_FCM_SERVICE_ACCOUNT_JSON=
PPB_WNS_PACKAGE_SID=
PPB_WNS_CLIENT_SECRET=