doppler.yaml

# ALO-166: Doppler project layout for spooool. Currently sharing the
# existing `quickapp` Doppler project — the worker is still named `spooool`
# in wrangler.toml; the Doppler project name is just where the secrets
# live and can be migrated to its own project later.
#
# CI **does not** use the Doppler CLI — it pulls secrets directly from the
# Doppler v3 REST API via scripts/sync-doppler-secrets.mjs, which keeps the
# CI image lean and removes one binary from the trust chain. This file is
# kept for local-dev convenience: `doppler run -- npm run dev` still works
# if you have the CLI installed.
#
# Project layout (in Doppler):
#   quickapp                  ← shared project (rename to `spooool` later if desired)
#     ├─ dev                  local development (`doppler run -- npm run dev`)
#     ├─ staging              staging deploy (push to main → workflow runs)
#     └─ production           prod deploy (manual workflow_dispatch)
#
# Per-config secrets (the script splits on these prefixes):
#
#   # CI/CD only — never forwarded to the worker runtime:
#   CLOUDFLARE_API_TOKEN          required for wrangler deploy + logpush setup
#   CLOUDFLARE_ACCOUNT_ID         required for wrangler deploy
#
#   # Worker secrets — synced via `wrangler secret bulk`:
#   BETTER_AUTH_SECRET            random 32+ byte string
#   BETTER_AUTH_URL               public origin
#   CF_STREAM_API_TOKEN
#   CF_STREAM_WEBHOOK_SECRET
#   STREAM_ENABLED                "true" to route uploads through Stream
#   SENTRY_DSN                    worker-side Sentry DSN
#   SENTRY_AUTH_TOKEN             upload sourcemaps on build (also read by build)
#   LOOPS_API_KEY                 transactional email
#   STRIPE_SECRET_KEY             monetization (when E6 lands)
#   STRIPE_WEBHOOK_SECRET
#   POLAR_CLIENT_ID               Polar OAuth app client ID (creator partner onboarding)
#   POLAR_CLIENT_SECRET           Polar OAuth app client secret
#   YOUTUBE_API_KEY               YouTube Data API v3 key for multi-source feeds (ALO-642)
#
#   # Frontend env — written to .env.production.local, baked into the bundle:
#   VITE_SENTRY_DSN               browser-side Sentry DSN
#   VITE_POSTHOG_KEY              browser-side PostHog project API key
#   VITE_POSTHOG_HOST             "https://us.i.posthog.com" (cloud) or self-hosted URL
#
#   # Hindsight agent memory (Cursor hooks + ~/.cursor/hindsight-mcp-spooool.sh):
#   HINDSIGHT_BASE_URL            "https://hindsight.fly.pm"
#   HINDSIGHT_API_KEY             tenant API key (= HINDSIGHT_API_TENANT_API_KEY on VM)
#   HINDSIGHT_CF_ACCESS_CLIENT_ID Cloudflare Access service token (Client ID)
#   HINDSIGHT_CF_ACCESS_CLIENT_SECRET
#
# Adding a new secret:
#   - Add it under the appropriate config(s) in the Doppler dashboard.
#   - No repo changes needed unless the prefix logic in
#     scripts/sync-doppler-secrets.mjs needs adjusting.
#
# CI repo secrets:
#   DOPPLER_TOKEN_STAGING       service token scoped to quickapp/staging
#   DOPPLER_TOKEN_PROD          service token scoped to quickapp/production
#
# Service tokens are read-only by default and config-scoped — generate them
# from Doppler → Project → Access → Service Tokens.

setup:
  project: quickapp
  config: dev