-
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path.env.example
More file actions
170 lines (157 loc) · 9.48 KB
/
Copy path.env.example
File metadata and controls
170 lines (157 loc) · 9.48 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
# ====================================================================================
# Nordcom Commerce - Environment Variables
# ====================================================================================
# Example .env file for local development.
# Copy this file to .env and fill in the values.
#
# Note: the `.env` file is ignored by git.
# Contact Filiph Sandström <filfat@hotmail.se> if you need help.
# ====================================================================================
# Hostname for the platform's status/error pages and shop discovery service.
# Dev: landing.localhost (served by portless). Prod: e.g. shops.nordcom.io.
SERVICE_DOMAIN=landing.localhost
# Hostname for the admin dashboard. Dev: admin.localhost. Prod: e.g. admin.example.com.
# Used to build absolute URLs (manifest scope, metadataBase, Shopify embed host).
ADMIN_DOMAIN=admin.localhost
# Optional. Full origin (scheme + host + port) the storefront trusts as the sender
# of theme live-preview postMessages. Defaults to `https://${ADMIN_DOMAIN}`. Set
# this only when the admin is served over non-https or on a non-default port —
# otherwise the storefront's preview bridge silently drops every preview message.
# ADMIN_ORIGIN=https://admin.example.com
# Hostname for the marketing / landing site. Dev: landing.localhost. Prod: e.g. example.com.
# Used by the admin for assets such as the logo and post sign-in redirects.
LANDING_DOMAIN=landing.localhost
# Optional. Base URL of the documentation site, proxied by the landing app under `/docs/*`
# (and the site's own `/commerce/*` base path). Include the upstream base path — the docs
# are a static export served from `/commerce` on GitHub Pages. Defaults to the public
# GitHub Pages build.
# DOCS_DOMAIN=https://docs.nordcom.store/
# Optional. Dev-only fallback shop used when the storefront middleware sees the
# bare app URL (https://storefront.localhost via portless) with no shop slug.
# Defaults to `demo.nordcom.store` for backwards-compat. Set to whichever shop
# handle exists in your local `shops` table.
STOREFRONT_DEV_SHOP=
# Optional. Vercel preview fallback shop. A preview deploy is served on an ephemeral
# `*.vercel.app` host that matches no tenant, so the middleware renders this shop
# instead of 404ing. Takes precedence over STOREFRONT_DEV_SHOP; falls back to the
# first seeded shop when unset — which on the shared prod `shops` table is an
# orphan tenant (`missing.nordcom.store`) that 404s, so this MUST be pinned on
# Vercel. Set on the storefront project's Vercel *Preview* environment to whichever
# tenant (in the shared prod `shops` table) PRs should render; prod uses `demo.nordcom.store`.
STOREFRONT_PREVIEW_SHOP=
# Convex. ============================================================================
# Convex backend the apps talk to. CONVEX_URL is the deployment URL for
# server-side clients; NEXT_PUBLIC_CONVEX_URL is the same value exposed to the
# browser. CONVEX_DEPLOY_KEY authenticates `convex deploy`/`convex codegen`
# against a deployment in CI (leave empty locally — `convex dev` provisions an
# anonymous local backend instead).
CONVEX_URL=http://127.0.0.1:3210
CONVEX_DEPLOY_KEY=
NEXT_PUBLIC_CONVEX_URL=http://127.0.0.1:3210
# HMAC secret for the storefront's /api/revalidate/convex route — Convex signs
# revalidation events with this and the route verifies it BEFORE any tenant or
# cache work. Distinct from SHOPIFY_WEBHOOK_SECRET (different name, different
# direction: that one validates inbound Shopify webhooks).
#
# Rotation (dual-accept window): the Convex deployment signs with ONLY the
# current value (`convex env set CONVEX_REVALIDATE_SECRET …`; it never reads
# _PREVIOUS). The Next route verifies against {current, previous}, so to rotate:
# 1. set _PREVIOUS here (+ on Vercel) to the old value, set CONVEX_REVALIDATE_SECRET to the new one,
# 2. update the Convex deployment's CONVEX_REVALIDATE_SECRET to the new value,
# 3. once no in-flight delivery is signed with the old value, unset _PREVIOUS.
# Deliveries signed with the old secret keep verifying (200) only while
# _PREVIOUS is set; they 401 the moment it is unset.
CONVEX_REVALIDATE_SECRET=
CONVEX_REVALIDATE_SECRET_PREVIOUS=
# Convex auth — STOREFRONT CUSTOMER PATH ONLY (kept; see correction in spec).
# Admin operators now authenticate via Clerk (above); the storefront customJwt
# RS256 path is a separate provider that stays until a future storefront migration.
# CONVEX_AUTH_ISSUER is the `iss` claim (storefront origin publishing the JWKS);
# CONVEX_AUTH_APPLICATION_ID is the `aud` claim; CONVEX_AUTH_JWKS_URL is where
# the Convex deployment fetches signing keys. All three must also be set on the
# Convex deployment itself (`convex env set`).
CONVEX_AUTH_ISSUER=
CONVEX_AUTH_APPLICATION_ID=
CONVEX_AUTH_JWKS_URL=
# RS256 private key (PKCS8 PEM; the single-line literal-\n form is accepted) the
# STOREFRONT signs Convex-bound customer JWTs with. Server-only — never NEXT_PUBLIC.
# The public half is DERIVED from it (never a separate env var) and served by the
# storefront at /api/auth/convex-jwks/; set CONVEX_AUTH_JWKS_URL to that route's
# absolute URL on the Convex deployment. Generate with:
# openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048
CONVEX_AUTH_PRIVATE_KEY=
# Server-trust secret for packages/db's identity-less server ConvexHttpClient. The db
# seam reaches Convex for pre-tenant reads (Shop.findByDomain in middleware, before any
# identity) and cross-tenant reads (findAll, byDomainWithCredentials) via the public
# serverQuery/serverMutation constructors, which admit a caller ONLY when it presents this
# secret. Server-only — never exposed to the browser. Must also be set on the Convex
# deployment (`convex env set CONVEX_SERVER_SECRET …`). Generate with `openssl rand -hex 32`.
CONVEX_SERVER_SECRET=dev-local-secret
# Clerk (admin operator authentication). ============================================
# Dev instance (local dev, Vercel Preview, CI/e2e): use pk_test_… / sk_test_… keys.
# Prod instance (Vercel Production): use pk_live_… / sk_live_… keys.
# Set on the admin Vercel project for both Preview and Production scopes.
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_…
CLERK_SECRET_KEY=sk_test_…
# Frontend API URL of the Clerk instance — used by Convex's auth.config.ts `domain`
# field so Convex can fetch JWKS and validate operator tokens. Must also be set on
# the Convex deployment via `convex env set` (dev: pnpm convex:env set; prod: CI).
CLERK_FRONTEND_API_URL=https://internal-roughy-49.clerk.accounts.dev
# Convex deployment var — svix webhook signature verification in the Clerk httpAction.
# Register the webhook at <convex-site>/clerk-webhooks in the Clerk dashboard, then
# copy the signing secret here AND onto the Convex deployment (`convex env set`).
CLERK_WEBHOOK_SIGNING_SECRET=whsec_…
# Sign-in / sign-up route config. These can also be hardcoded in middleware.ts;
# keeping them here allows per-environment overrides without a redeploy.
NEXT_PUBLIC_CLERK_SIGN_IN_URL=/auth/sign-in
NEXT_PUBLIC_CLERK_SIGN_UP_URL=/auth/sign-up
NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL=/
NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL=/onboarding
# Shopify OAuth — scaffold/placeholder only (decision #5; no working button yet).
# SHOPIFY_OAUTH_CLIENT_ID=
# SHOPIFY_OAUTH_CLIENT_SECRET=
# ====================================================================================
# CMS (@nordcom/commerce-cms). ========================================================
# Public base URL of the storefront, used by the admin's live-preview iframe
# to build preview URLs. Dev: https://storefront.localhost. Prod: e.g. https://storefront.example.
STOREFRONT_BASE_URL=https://storefront.localhost
# Required for the storefront's /[domain]/api/cms-preview route. The admin's
# "preview" button sends ?secret=<value> here to flip Next.js draft mode on.
# Generate with `openssl rand -hex 32`.
STOREFRONT_PREVIEW_SECRET=
# Legacy S3/R2 storage endpoints for migrated CMS media assets (the key-addressed
# fallback URLs in @nordcom/commerce-cms/media/urls). New uploads land in Convex
# file storage; local development can leave these empty.
S3_BUCKET=
S3_ENDPOINT=
S3_REGION=
S3_ACCESS_KEY_ID=
S3_SECRET_ACCESS_KEY=
R2_PUBLIC_ENDPOINT=
# Email.
RESEND_API_KEY=
# Services. ==========================================================================
SHOPIFY_API_KEY=
SHOPIFY_API_SECRET_KEY=
# HMAC secret for validating Shopify webhook authenticity. Required in production.
SHOPIFY_WEBHOOK_SECRET=
# Logging. ===========================================================================
# Coverage. ==========================================================================
CODECOV_TOKEN=
# Remote Cache. ======================================================================
# Turborepo Remote Cache (Vercel-hosted). Share build/test cache between local dev and
# CI runners. Create a token at https://vercel.com/account/tokens.
TURBO_TOKEN=
# Vercel team/account slug that owns the Remote Cache. Must match the account that
# issued TURBO_TOKEN.
TURBO_TEAM=
# Domain provisioning (admin only). =================================================
# When set, the admin's Settings → Domain screen adds each customer-facing domain to the
# storefront's Vercel project and verifies it via the Vercel API. When unset, it falls back
# to a DNS-over-HTTPS check that the domain points at SERVICE_DOMAIN (or Vercel's targets).
# *.localhost domains auto-verify in dev.
VERCEL_TOKEN=
VERCEL_STOREFRONT_PROJECT_ID=
VERCEL_TEAM_ID=
# Misc. ==============================================================================
VERCEL_AUTOMATION_BYPASS_SECRET=