.env.example

# ─────────────────────────────────────────────────────────────────────────────
#  bullmoose — the one env file.  Copy to `.env` and fill in.
# ─────────────────────────────────────────────────────────────────────────────
#
#  `.env` is gitignored and chmod 600. THIS file is committed and must never
#  hold a value — it exists so "what do I need?" is answerable without access
#  to the secrets themselves.
#
#  Fill the EXTERNAL block, then:  node infra/bootstrap.mjs secrets
#  The GENERATED block is written for you and reused on every re-run.
#
#  ⚠️ Back up your real `.env`. A machine without it reads as "no secrets
#  exist", and the honest response to that state is to mint new ones — which
#  for VAULT_MASTER_KEY is unrecoverable. bootstrap refuses rather than doing
#  it, but a refusal is a seatbelt, not a backup.

## ── GENERATED ────────────────────────────────────────────────────────────────
## Written by `bootstrap secrets`. Leave blank on a first run.
## Rotating them is not symmetric:
##   VAULT_MASTER_KEY   every sealed credential becomes UNDECRYPTABLE. No recovery.
##   SHARE_SIGNING_KEY  every outstanding share link stops verifying.
##   ADMIN_TOKEN        stored admin credentials stop working.
##   INTERNAL_TOKEN     survivable — all five workers get the same new value.
INTERNAL_TOKEN=
SHARE_SIGNING_KEY=
ADMIN_TOKEN=
VAULT_MASTER_KEY=

## ── EXTERNAL ─────────────────────────────────────────────────────────────────
## You supply these. bootstrap installs them and never generates them.

# Zone:Edit + Email Routing:Edit + DNS:Edit  (the provision worker uses this at
# RUNTIME to manage DNS — it is NOT the token that deploys workers)
CF_API_TOKEN=

# IAM: ses:SendRawEmail (+ identity mgmt on provision)
SES_ACCESS_KEY_ID=
SES_SECRET_ACCESS_KEY=

# only if RELAY=cloudflare (Workers Paid)
CF_EMAIL_API_TOKEN=

# only if an AI Gateway alias exists
GATEWAY_TOKEN=

## ── LOCAL CONVENIENCE (optional) ─────────────────────────────────────────────
## Not installed as worker secrets. Here so one file is enough to work locally
## instead of hunting through shell history.

# Lets `wrangler` run without `wrangler login`. Same value as the
# CLOUDFLARE_ACCOUNT_ID GitHub secret.
CLOUDFLARE_ACCOUNT_ID=

# The FTS backfill needs INTERNAL_TOKEN above and this base URL:
#   curl -X POST "$INGEST/admin/fts/backfill?limit=25" -H "x-internal-token: $INTERNAL_TOKEN"
INGEST=