.env.example

# The app reads environment from .env. Copy this to .env and customize to use.
# To source the .env file on the shell use `set -a; source .env; set +a` then run a command the depends on these env vars.

# Prisma uses this for a database connection.
DATABASE_URL="postgresql://orcaadmin:password@localhost/orca?schema=orca_public"

# Prisma uses an adapter by Neon to use this provider's serverless Postgres technology. 
DATABASE_SERVERLESS="false"

# Prisma uses this for migrations - enables you to run migrations with a different privileged user than the app user for instance
DATABASE_URL_DIRECT="postgresql://orcaadmin:password@localhost/orca?schema=orca_public"

# Server settings
USE_SECURE_COOKIES="false"
PUBLIC_HTTP_PROTOCOL="http" # "https" is required for prod. "http" OK for local dev, except did:web identifiers don't resolve even locally
PUBLIC_DEV_SSL="false" # set http protocol to "https" AND set this to "true" to use vite plugin for self-signed certs for local dev.  Enables testing of HTTPS-only browser features like clipboard API and CHAPI Polyfill

# Default org settings: If an org is not found, app can fall back to one by domain=DEFAULT_ORG_DOMAIN
DEFAULT_ORG_ENABLED="false"
DEFAULT_ORG_DOMAIN="localhost:5173"

# EMAIL settings --- use empty strings for localhost debug console delivery - use "none" as MAILGUN_API_KEY to not use mailgun. 
# Setting it to just an empty string isn't picked up by system as a change, so it doesn't reset the value to something falsy. We'll use "none" instead.
MAILGUN_DOMAIN=""
MAILGUN_API_KEY="none"
MAILGUN_HOST="api.mailgun.net"  # use "api.eu.mailgun.net" for EU delivery

# SMTP settings --- optional, used when Mailgun is disabled.
# Precedence in src/lib/email/sendEmail.ts:
#   1. MAILGUN_API_KEY set and != "none"  -> Mailgun
#   2. SMTP_HOST set                      -> SMTP (this block)
#   3. otherwise                          -> nodemailer jsonTransport (console)
# Leave SMTP_HOST empty for local dev; the PoC production deployment
# sets these via CI from GitHub Actions secrets.
SMTP_HOST=""
SMTP_PORT="587"
SMTP_SECURE="false"
SMTP_USER=""
SMTP_PASSWORD=""

# S3 Configuration
S3_REGION="us-west-1"
S3_BUCKET_NAME="orca-media"  # match the value in infra/cdk.json for mediaBucketName
S3_USE_LOCALSTACK="true"  # only true for local stack, otherwise set this to "false"
S3_URL="http://127.0.0.1:4566"  # this will be ignored if S3_USE_LOCALSTACK is false, don't use localhost or it tries IP v6
AWS_ACCESS_KEY_ID="test"
AWS_SECRET_ACCESS_KEY="secret"

# Symmetric key used to encrypt sensitive per-organization config values stored in
# Organization.json (e.g. Transaction Service API key). Must be 32 random bytes,
# base64-encoded. Generate with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
ORG_CONFIG_ENCRYPTION_KEY=

# set this to `/media` for local storage, to the cloud front distribution doamin in production, and the setting below for localstack 
PUBLIC_MEDIA_DOMAIN="/media"

# Footer link URLs (optional, defaults to /privacy, /terms, /contact if not set)
# Supports both relative paths (e.g., /privacy) and absolute URLs (e.g., https://example.com/privacy)
# PUBLIC_PRIVACY_URL="/privacy"
# PUBLIC_TERMS_URL="/terms"
# PUBLIC_CONTACT_URL="/contact"

# Bulk award UI: minimum delay in ms after each row completes before starting the next (default 500)
# PUBLIC_BULK_AWARD_REQUEST_INTERVAL_MS="500"