.env.example

# meith-board — environment, on Vercel.
#
# Nothing on Vercel reads this file. The platform holds each of these as a
# project environment variable, and the Deploy Button in README.md asks for the
# ones it cannot provision itself. This is the reference for what they mean —
# and the file to copy to .env.local to run the same board on your own machine.

# ─── Drivers ─────────────────────────────────────────────────────────────────

# An instance is created for a request, may be frozen between requests, and is
# destroyed without warning; it has a writable /tmp nothing else can read and no
# background process of its own. Every driver below therefore keeps its state
# somewhere outside the instance, and these five values are not a default to
# tune — they are the one combination the board supports on functions.
#
# DATA_SOURCE=fixture is a read-only sample board with no write side.
# QUEUE_DRIVER=memory loses every queued job when the instance goes away, which
# is after almost every request, and the board already refuses it in production.
# CACHE_DRIVER=next and memory cache inside the process, so each instance serves
# its own stale copy for up to a minute. FILESTORE_DRIVER=local writes to a disk
# no other instance can read and that is discarded with the instance — on Vercel
# the board refuses it outright rather than losing uploads quietly.
#
# The deploy form asks for none of them. On Vercel the board works each one out
# from what the linked stores publish: a DATABASE_URL means postgres for the
# data source and the queue, a Redis connection string means CACHE_DRIVER=redis,
# a Blob store's read-write token means FILESTORE_DRIVER=blob, and a
# RESEND_API_KEY with a MAIL_FROM beside it means mail over the provider's HTTPS
# API. Setting one here overrides the derivation, which is what this file is for
# when you copy it to .env.local.
#
# Every one of those derivations is scoped to Vercel, and each fires only from a
# value that is unambiguously the thing itself — a redis:// or rediss:// URL, a
# read-write token. A board you run anywhere else is untouched by all of it and
# still takes these values from this file, exactly as it did before.
#
# A derivation that cannot resolve is a configuration error, not an invitation
# to pick something safe-looking. On Vercel, with the cache or the object store
# missing, the board refuses to boot and names every variable it looked at. It
# will not quietly cache inside the instance, and it will not quietly write
# uploads to a disk that is about to disappear.
DATA_SOURCE=postgres
QUEUE_DRIVER=postgres
CACHE_DRIVER=redis
FILESTORE_DRIVER=blob
MAIL_DRIVER=http

# ─── Required ────────────────────────────────────────────────────────────────

# Your Postgres connection string.
#
# If it is a managed database that offers a TRANSACTION-MODE POOLER string, use
# that rather than the direct one — Neon, Supabase and their kind hand out both,
# and on the direct string a board works in testing and starts refusing
# connections under the first real traffic, with an error that names the
# database rather than the cause. Your own Postgres, with a fixed number of
# processes in front of it, does not need one.
DATABASE_URL=

# The other half of that pair: the DIRECT (non-pooler) string, used only by
# `meith migrate` and `meith backup`. Migrations hold a session-level
# advisory lock so that two deploys landing together queue instead of both
# applying the same migration, and a transaction-mode pooler cannot hold that
# lock: it takes the connection back the moment the lock statement ends, which
# leaves the lock on a backend another client gets. Set both and each gets the
# connection it needs; set only DATABASE_URL and migrations use it too, which is
# right for a Postgres you run yourself.
#
# On Vercel this is not optional, and it is no longer yours to copy. DATABASE_URL
# here is the pooler string, the build runs `meith migrate` against it, and
# /install takes the second of those two session locks on first run. Left blank,
# the board reads Neon's own direct string — `DATABASE_URL_UNPOOLED` first, then
# `POSTGRES_URL_NON_POOLING` — and refuses to boot if neither is there, naming
# both. Never `POSTGRES_URL`: that one is pooled.
DIRECT_DATABASE_URL=

# The shared cache — a Redis or Valkey endpoint, `rediss://` for TLS. Redis
# holds cache entries and nothing else: losing it costs the board a warm cache,
# not data, and signs nobody out. Left blank on Vercel, the board reads the
# Upstash store's own `KV_URL`, which is the one variable it publishes that
# speaks the Redis protocol — `KV_REST_API_URL` is an HTTPS endpoint and is
# never used for this. A name we do not know goes here by hand.
REDIS_URL=

# Session and token signing. No default, deliberately: a shipped default is a
# board every reader of the source can sign a session for.
#
#   node -e "console.log(require('crypto').randomBytes(32).toString('base64url'))"
AUTH_SECRET=

# The shared secret the tick caller presents to GET /api/system/tick. Generate
# it the same way. Without it the tick is unauthenticated, and the tick is how
# bans expire and digests send.
#
# Vercel Cron sends `Authorization: Bearer <CRON_SECRET>` and cannot be told to
# send any other name, so CRON_SECRET is the one to set here. The board accepts
# either name, and both when both are set. Whichever you use, 32 characters is
# the floor — stricter than the 16 Vercel's own cron documentation suggests, so
# a secret generated by following those instructions is rejected here.
CRON_SECRET=
# TICK_SECRET=

# Uploads, in the Vercel Blob store the Deploy Button provisions. A store
# attached to the project publishes BLOB_STORE_ID and nothing else — no token —
# because the SDK authenticates with the deployment's own OIDC identity: the
# board hands it the store id and lets it fetch the credential. There is nothing
# to type and nothing to mistype, and FILESTORE_DRIVER=blob derives from this
# variable being present.
#
# BLOB_READ_WRITE_TOKEN is the other way in, and you make it yourself on the
# store. Set it when something has to reach the store from OUTSIDE a Vercel
# deployment — `meith backup` run on your own machine is the case that
# matters — because there is no OIDC identity there to borrow. Set both and the
# board prefers the store id, unless the token names a different store, in which
# case the token wins: naming another store is a deliberate act.
#
# Every object is written with private access: an object URL is not a public
# link, and member content is served by the board, which is where permissions
# are checked. An upload is held whole in the instance's memory on the way in
# and on the way out, so the function's memory limit, not the store, is what
# caps a file.
BLOB_STORE_ID=
BLOB_READ_WRITE_TOKEN=

# Uploads in an S3-compatible bucket instead — AWS, R2, MinIO, Spaces. This is
# the portable option, and the one every other deployment of this board uses:
# a bucket is a thing you hold, and it is not the only way to get the objects
# out of it. Set FILESTORE_DRIVER=s3 above and the first four below; boot fails
# naming any that are missing. S3_ENDPOINT is for anything that is not AWS and
# switches the client to path-style addressing; set S3_REGION=auto for R2.
# S3_PUBLIC_BASE_URL is the host objects are *served* from when that is not the
# API endpoint.
# S3_BUCKET=
# S3_REGION=
# S3_ACCESS_KEY_ID=
# S3_SECRET_ACCESS_KEY=
# S3_ENDPOINT=
# S3_PUBLIC_BASE_URL=

# Mail over the provider's own HTTPS API, on 443 — the one outbound path a
# function can rely on. SMTP on port 25 is blocked by serverless egress and the
# board refuses it on Vercel; 587 with STARTTLS may work, but an API does not
# depend on the platform's egress rules staying as they are.
#
# MAIL_FROM is optional where a provider publishes the domain it sends from:
# with RESEND_API_KEY and RESEND_EMAIL_DOMAIN both set, the board sends from
# noreply@ that domain and this can stay empty. Set it to send from another
# address — it must be at a domain the provider has verified for you, and an
# address set here always wins over the derived one.
MAIL_FROM=

# Add the Resend integration to the project from Vercel's marketplace and it
# publishes its key and its sending domain under these names, which the board
# reads: with RESEND_API_KEY set, and either RESEND_EMAIL_DOMAIN or a MAIL_FROM
# beside it, the board sends over Resend's HTTPS API and
# needs neither of the two variables below. The mail driver itself is a plain
# JSON-over-HTTPS sender and is not Resend-specific — this is one injected name
# bridged to the generic pair, not a provider baked into the board.
RESEND_API_KEY=

# Any other provider with the same shape — a bearer token and an endpoint that
# accepts {from, to, subject, text, html, reply_to}. Set BOTH, plus
# MAIL_DRIVER=http above; they do not turn the driver on by themselves, and only
# RESEND_API_KEY implies it.
#
# Setting just one of them stands the Resend bridge down completely, on purpose:
# the board will not hand a key issued for Resend to an endpoint you chose, nor
# aim your token at Resend. Boot fails naming the half you left out. Delete
# RESEND_API_KEY once you have moved off Resend.
# MAIL_HTTP_ENDPOINT=
# MAIL_HTTP_TOKEN=

# ─── Optional ────────────────────────────────────────────────────────────────

# Absolute, no trailing slash. Used in mail, feeds and canonical URLs — every
# place a relative URL cannot work because there is no request to be relative to.
#
# Optional: leave it blank and the installer asks, prefilled from the address you
# load /install at, and stores the answer on the board where the settings screen
# can change it without a redeploy. Set it here and it wins outright.
APP_URL=