example.env.local

# Local dev secrets / machine-specific overrides. COMMITTED as an empty template.
#
# Copy to `.env.local` (gitignored) and fill in ONLY what you need:
#
#     cp example.env.local .env.local
#
# Everything here is OPTIONAL: the core stack (login, offers, chat, contacts,
# content) runs with zero secrets via dev.config.ts. Secret blocks below unlock
# individual extra features and are injected only into the apps that use them.
# Port overrides are read only for port resolution and are not forwarded into
# child process environments.

# --- SMS one-time-password (user-service) ----------------------------------
# By default login uses the static dummy code from dev.config.ts
# (LOGIN_CODE_DUMMY_FOR_ALL) and never calls an SMS provider. To send REAL SMS,
# set a real token here AND remove LOGIN_CODE_DUMMY_FOR_ALL from dev.config.ts
# (an empty value here is not enough — it's a committed default, not a secret).
PRELUDE_API_TOKEN=

# --- Account-deletion captcha (user-service) -------------------------------
TURNSTILE_SECRET_KEY=
TURNSTILE_EXPECTED_HOSTNAME=

# --- Expo push delivery (contact-service + notification-service) -----------
EXPO_ACCESS_TOKEN=

# --- Vexl notification-token signing (notification-service) ----------------
# Dev reuses the dev ECDSA pair from dev.config.ts. Override for real FCM.
# Format: base64-encoded PEM (PublicKeyPemBase64 / PrivateKeyPemBase64).
FCM_TOKEN_PUBLIC_KEY=
FCM_TOKEN_PRIVATE_KEY=

# --- Location autocomplete (location-service) ------------------------------
GOOGLE_PLACES_API_KEY=

# --- CMS-backed content (content-service) ----------------------------------
WEBFLOW_TOKEN=
WEBFLOW_EVENTS_COLLECTION_ID=
WEBFLOW_SPEAKERS_COLLECTION_ID=
WEBFLOW_BLOG_COLLECTION_ID=
CLEAR_CACHE_TOKEN_HASH=

# --- Donations / BTCPay (content-service) ----------------------------------
BTC_PAY_SERVER_URL=
BTC_PAY_SERVER_API_KEY=
BTC_PAY_SERVER_STORE_ID=
BTC_PAY_SERVER_WEBHOOK_SECRET=

# --- S3 (contact-service club images + backoffice slideshows) --------------
# Local dev uses dockerized MinIO automatically (creds + endpoint come from
# dev.config.ts). Only set these to point at a REAL S3 bucket instead.
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=

# --- Sentry error reporting (all backend services) -------------------------
# Off by default. Set a DSN to test Sentry reporting locally; it is injected
# into every backend service, so all events land in that one Sentry project
# (production uses one project/DSN per service, set in the infra repo).
SENTRY_DSN=

# --- Port overrides (machines with conflicts) ------------------------------
# Any port from dev.config.ts can be overridden as <SCREAMING_SNAKE>_PORT, e.g.:
# POSTGRES_PORT=5433
# USER_SERVICE_PORT=4001
# GRAFANA_PORT=3031