.env.example

# Copy to .env and fill in the values marked REQUIRED. No default here is a
# real hostname — every URL is either localhost (for a fully local stack) or
# something you fill in yourself. See docs/deployment.md for TLS/reverse-proxy
# setup once you're ready to expose this beyond your own machine.

# ── Postgres ────────────────────────────────────────────────────────────
POSTGRES_USER=pixel_index
POSTGRES_PASSWORD=change-me
POSTGRES_DB=pixel_index

# ── API (services/api) ──────────────────────────────────────────────────
# DATABASE_URL is not set here — docker-compose.yml builds it from
# POSTGRES_* above, so there is only one place connection details live. Set
# it yourself only if you're pointing the api service at a Postgres this
# compose file doesn't manage (edit docker-compose.yml's `api.environment`).
RENDERER_URL=http://renderer:3000

# REQUIRED: exact origins allowed to call the API with credentials — no
# wildcards, no trailing slash. Add your own domain(s) once you're not just
# running this locally. Comma-separated for more than one.
PUBLIC_WEB_ORIGIN=http://localhost:8080

# Optional, and off unless you set it. Comma-separated ORIGIN PATTERNS for
# frontends whose hostname you cannot know in advance because the platform
# mints a fresh one per deploy — a Vercel PR preview is
# https://<project>-<build-hash>-<team>.vercel.app, so no exact entry above
# can ever match it.
#
# Rules, enforced at boot: https only, exactly one `*`, and `*` never crosses
# a dot, so it can only ever stand in for part of ONE hostname label. A
# whole-label wildcard (https://*.vercel.app) is rejected — it would hand
# credentialed access to every project on a shared platform domain.
#
# Anything that matches can make credentialed cross-origin calls, so pin as
# much literal text as your platform allows — on Vercel include your team
# slug, which a stranger cannot mint under your project's name:
# PUBLIC_WEB_ORIGIN_PATTERNS=https://my-project-*-my-team.vercel.app

# REQUIRED: this API's own externally-reachable origin. Discord's OAuth
# redirect_uri is always ${PUBLIC_API_ORIGIN}/callback — it must exactly
# match what you register in the Discord Developer Portal (see
# services/api/README.md, "Setting up the Discord application").
PUBLIC_API_ORIGIN=http://localhost:3000

# REQUIRED: create a Discord application at https://discord.com/developers/applications
# and fill these in — see services/api/README.md for the exact steps.
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=

# REQUIRED: signs access tokens and the OAuth state cookie. Generate with:
#   openssl rand -base64 48
SESSION_SECRET=

# Optional, comma-separated Discord USER ids that receive Admin. This also
# works without a guild configured, so a self-hosted index always has a way
# to enable its read-only user directory.
DISCORD_ADMIN_IDS=

# Optional community integration. Leave this entire block blank to retain a
# fully functional self-hosted index where every logged-in user may submit.
# When DISCORD_GUILD_ID is set, the invite URL and encryption key are required.
# The API then requests `guilds.members.read`, retains the user's OAuth grant,
# and revalidates membership/roles directly with Discord (no bot or Pico).
DISCORD_GUILD_ID=
DISCORD_MODERATOR_ROLE_IDS=
DISCORD_INVITE_URL=

# API service secret only. Encrypts retained Discord access/refresh tokens in
# Postgres with AES-256-GCM. Generate once, keep it stable, and back it up:
#   openssl rand -base64 32
DISCORD_OAUTH_TOKEN_ENCRYPTION_KEY=

# Recheck at most once per minute. Lower is fresher but increases Discord API
# traffic and makes brief Discord outages more visible to users.
DISCORD_MEMBERSHIP_CACHE_TTL_MS=60000

# Optional (#63). A static, non-rotating shared secret for the scheduled
# backup.yml workflow — GET /api/v1/admin/backup checks this against the
# X-Backup-Api-Key request header, independently of a Discord admin session.
# Leave blank to disable that route's automation path entirely (it still
# works for a logged-in admin). Generate with, and set the SAME value as
# this repository's BACKUP_API_KEY GitHub Actions secret:
#   openssl rand -base64 32
BACKUP_API_KEY=

# Optional, build-time only, see services/api/Dockerfile. Which commit GET /
# and GET /api/v1/meta report themselves as running — purely informational,
# so leaving this unset is fine (they report commit: null instead of failing
# the build). Left blank here on purpose: a fixed value in this file would go
# stale the moment you build again from a newer commit. Compose does read
# this file for interpolation, so setting it here works too, but the freshest
# way is to pass it on the command line at build time instead:
#   API_COMMIT=$(git rev-parse HEAD) docker compose up --build
API_COMMIT=

# ── Frontend (apps/web) — build-time only, see apps/web/Dockerfile ───────
# Where the browser should reach the API. Baked into the built JS bundle;
# changing this means rebuilding the web image (`docker compose build web`).
VITE_API_BASE_URL=http://localhost:3000

# ── Ports exposed on the host ────────────────────────────────────────────
WEB_PORT=8080
API_PORT_HOST=3000