.env.example

# Database — use an absolute path on an appdata mount (not a FUSE share)
DATABASE_URL="file:/data/phatt-picks.db"

# App
NEXTAUTH_URL="https://pickems.phatt.vip"
# Generate: openssl rand -base64 32
NEXTAUTH_SECRET="REPLACE_ME"

# Steam Web API key — server-side only, never sent to client
STEAM_API_KEY="REPLACE_ME"

# Write path — push picks back to Valve (M5). DESTRUCTIVE: "true" overwrites the
# owner's live picks on Valve's servers. Confirmed viable by the M0 probe
# (GetTournamentItems returned 32 lockable team items). Leave "false" for the
# first tournament run — read-only: picks stay local and mirror in via the read
# path, and the leaderboard is unaffected. Flip to "true" only for deploy-smoke.
WRITE_ENABLED="false"

# Encryption key for per-user Valve auth codes (32-byte hex)
# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
AUTH_CODE_ENCRYPTION_KEY="REPLACE_ME"

# Web Push VAPID keys
# Generate: npx web-push generate-vapid-keys
VAPID_PUBLIC_KEY="REPLACE_ME"
VAPID_PRIVATE_KEY="REPLACE_ME"
VAPID_SUBJECT="mailto:brandon@phatt.tech"

# Cloudflare Turnstile CAPTCHA (PHA-881) — required in production for local account creation.
# Get keys at https://dash.cloudflare.com/?to=/:account/turnstile
# Test keys (always pass, safe for staging):
#   NEXT_PUBLIC_TURNSTILE_SITE_KEY="1x00000000000000000000AA"
#   TURNSTILE_SECRET_KEY="1x0000000000000000000000000000000AA"
# When unset: CAPTCHA is skipped (local dev convenience). Both must be set to enforce.
NEXT_PUBLIC_TURNSTILE_SITE_KEY="REPLACE_ME"
TURNSTILE_SECRET_KEY="REPLACE_ME"

# Live Swiss W-L standings (PHA-902): the standings table crawls the HLTV event
# page through the shared crawl4ai service (HLTV Cloudflare-gates a direct fetch).
# Defaults to the phattvip container name; override for another topology. When
# unreachable the standings panel just stays hidden — nothing else breaks.
CRAWL4AI_URL="http://crawl4ai:11235"

# Owner SteamID64 (string) — unlocks the /profile admin tools + /api/players/local*
# cleanup endpoints. The gate FAILS CLOSED when unset (nobody is owner), so if this
# is missing in prod the owner can't see the delete-local-user tooling (this exact
# omission was the PHA-890 live blocker). Set it.
OWNER_STEAM_ID=""

# crawl4ai bearer token — only the team-stats gather tooling sends it. Leave blank
# if your crawl4ai instance doesn't require auth.
CRAWL4AI_API_TOKEN=""

# Pre-lock push reminders (PHA-929). The in-process scheduler (src/instrumentation.ts,
# ~5-min tick) that fires the 24h/1h warnings is ON by default (PHA-996) — no env needed.
# Set this to 1/true ONLY to turn it OFF.
PRELOCK_REMINDERS_DISABLED=""
# OPTIONAL override for the reminder cutoffs. Unset = use the committed COLOGNE_LOCK_SCHEDULE
# (src/lib/lock-schedule-core.ts). e.g. {"107":{"name":"Stage III","lockAt":"2026-06-11T10:30:00Z"}}
STAGE_LOCKS_JSON=""
# Valve tournament event id (layout's internal id, NOT the HLTV event id).
# Unset = the registry's clock-derived current event (PHA-1046); set to pin one event for a dry run.
EVENT_ID=""

# Node environment
NODE_ENV="production"