.env.example

# =============================================================
# .env.example
# Copy this file to .env and fill in your values.
# NEVER commit .env to git — it contains secrets.
# This .env.example file IS committed — it documents what is needed.
# =============================================================


# -------------------------------------------------------------
# DATABASE
# -------------------------------------------------------------
DB_HOST=localhost
DB_PORT=5432
DB_NAME=fds
DB_USER=postgres
DB_PASSWORD=your_db_password_here


# -------------------------------------------------------------
# API SERVER
# -------------------------------------------------------------
PORT=3000
NODE_ENV=development          # development | production


# -------------------------------------------------------------
# FILE STORAGE
# Path on the server where raw uploaded files are stored.
# Must be an absolute path. Directory must exist and be writable.
# -------------------------------------------------------------
FILE_STORAGE_PATH=/var/saeon-data/raw_files


# -------------------------------------------------------------
# AUTH — Microsoft Azure AD (preferred for SAEON staff)
# Get these from your Azure App Registration:
#   Azure Portal → Azure Active Directory → App registrations
#   → New registration → name it "SAEON Field Data"
#
# MICROSOFT_TENANT_ID   : your organisation's tenant ID
# MICROSOFT_CLIENT_ID   : the app's client (application) ID
# MICROSOFT_CLIENT_SECRET : a client secret generated in the app
# -------------------------------------------------------------
MICROSOFT_TENANT_ID=your_tenant_id_here
MICROSOFT_CLIENT_ID=your_client_id_here
MICROSOFT_CLIENT_SECRET=your_client_secret_here

# The URL your API is reachable at — used for OAuth redirect
# e.g. http://localhost:3000 in development
#      https://fielddata.saeon.ac.za in production
APP_URL=http://localhost:3000


# -------------------------------------------------------------
# AUTH — Keycloak (open source fallback if Microsoft is not viable)
# Leave blank if using Microsoft above.
# -------------------------------------------------------------
KEYCLOAK_URL=
KEYCLOAK_REALM=
KEYCLOAK_CLIENT_ID=


# -------------------------------------------------------------
# JWT
# Secret used to sign session tokens issued by the API.
# Generate a strong random string — e.g.:
#   node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"
# -------------------------------------------------------------
JWT_SECRET=replace_with_a_long_random_string
JWT_EXPIRES_IN=8h