.env.example

# =============================================================================
# Local development defaults. Copy to .env.local and fill in.
# Production values live in the Vercel dashboard, NEVER in this file.
# =============================================================================

# --- Database ---------------------------------------------------------------
# Local: a Postgres server on your machine.
# Production: Azure Database for PostgreSQL Flexible Server (free tier).
#   Azure connection strings require SSL. Example shape:
#     DATABASE_URL=postgresql://USER:PASS@HOST.postgres.database.azure.com:5432/asmita?sslmode=require
#   DIRECT_URL should match (used by Prisma migrate).
#   SHADOW_DATABASE_URL only needed if running `prisma migrate dev` against
#   a remote DB; usually leave unset in production.
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/asmita
SHADOW_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/asmita_shadow
DIRECT_URL=postgresql://postgres:postgres@localhost:5432/asmita

# --- Secrets (generate with `openssl rand -hex 32`) -------------------------
ENCRYPTION_KEY=
JWT_SECRET=
CSRF_SECRET=

# --- Email (Resend) ---------------------------------------------------------
# Production: create a Resend API key, verify the meriasmita.org domain in Resend,
# add SPF, DKIM, DMARC DNS records before sending real notices.
RESEND_API_KEY=
EMAIL_FROM="Asmita <Notice@meriasmita.org>"
NOTICE_EMAIL_FROM="Asmita <Notice@meriasmita.org>"
TRANSACTIONAL_EMAIL_FROM="Asmita <Update@meriasmita.org>"
RESEND_FROM_EMAIL="Asmita <Notice@meriasmita.org>"
# Resend webhook signing secret (starts with whsec_). Get from Resend dashboard → Webhooks.
RESEND_WEBHOOK_SECRET=

# --- Content provenance (OpenAI) --------------------------------------------
# Powers the optional "deeper check" on /check-image: reads C2PA credentials and
# the SynthID watermark. The image is forwarded to OpenAI in memory and never
# stored by us (see docs/adr/002-consented-encrypted-media.md).
#
# OFF-BY-DEFAULT SAFETY GATE. The /api/check-image route returns 404 and the UI
# hides the deeper check unless ENABLE_PROVENANCE_CHECK=true. This forwards media
# to a third party, which ADR 002 forbids until legal sign-off, so do NOT set the
# flag in production or preview until those blockers clear. Local dev only for now.
ENABLE_PROVENANCE_CHECK=
OPENAI_API_KEY=

# --- Queue + cache ----------------------------------------------------------
# Vercel serverless functions are stateless: REDIS_URL must point to a
# managed Redis (Upstash, Azure Cache for Redis) for production.
# QUEUE_DRIVER=memory is dev-only.
REDIS_URL=redis://localhost:6379
QUEUE_DRIVER=memory
RATE_LIMIT_DRIVER=memory
EMAIL_PROOF_PERSISTENCE=memory
AUDIT_LOG_PERSISTENCE=memory
SECURITY_LOG_PERSISTENCE=memory
# Production MUST set these two to "database": in-memory OTP and notice-dedup
# state does not survive stateless serverless invocations (duplicate notices,
# broken OTP verification across instances).
OTP_PERSISTENCE=memory
NOTICE_DISPATCH_PERSISTENCE=memory

# --- App ---------------------------------------------------------------------
NEXT_PUBLIC_APP_URL=https://meriasmita.org
ADMIN_EMAILS=
# Optional sub-roles per admin email (default SUPER_ADMIN), e.g.
# ADMIN_ROLES=legal@example.org=LEGAL_ADVISOR,reviewer@example.org=CASE_REVIEWER
ADMIN_ROLES=
ADMIN_OTP_EMAIL=
ADMIN_TOTP_SECRET=

# --- Alerting ---------------------------------------------------------------
ON_CALL_WEBHOOK_URL=
ON_CALL_WEBHOOK_FORMAT=generic
ON_CALL_MIN_SEVERITY=warning

# --- Feature flags ----------------------------------------------------------
# Hash upload is Phase 2; platform API integrations are gated until verified.
ENABLE_HASH_UPLOAD=false
ENABLE_PLATFORM_API=false
TIER1_API_ENABLED_PLATFORMS=
TIER1_API_ACCESS_TOKEN=

# --- Vercel-only ------------------------------------------------------------
# Set on Vercel project, not here. Used by /api/cron/* routes to verify
# the request came from Vercel Cron, not an attacker.
CRON_SECRET=