.env.example

# ─── Database (API) ───
DATABASE_URL=postgres://postgres:your_password@localhost:5432/truss  # Postgres connection string (API)

# ─── API Server ───
API_PORT=8787                # Express server port (API)
QUERY_TIMEOUT_MS=10000       # SQL query timeout in ms (API)
SQL_MAX_ROWS=200             # Max rows returned per query (API)

# ─── Authentication - Ory Kratos (API) ───
KRATOS_PUBLIC_URL=http://localhost:4433              # Kratos public API endpoint (API)
KRATOS_ADMIN_URL=http://localhost:4434               # Kratos admin API endpoint (API)
KRATOS_ADMIN_TOKEN=your_kratos_admin_token           # Bearer token for Kratos admin proxy (API)
KRATOS_IDENTITY_SCHEMA_ID=default                    # Kratos identity schema to use (API)
KRATOS_OIDC_PROVIDERS=                               # Comma-separated social login provider ids, e.g. google,github (API)

# ─── Authorization - Ory Keto (API) ───
KETO_READ_URL=http://localhost:4466                  # Keto read API endpoint (API)
KETO_WRITE_URL=http://localhost:4467                 # Keto write/admin API endpoint (API)
KETO_ADMIN_TOKEN=your_keto_admin_token               # Bearer token for Keto admin proxy (API)

# ─── OAuth2 - Ory Hydra (API) ───
HYDRA_PUBLIC_URL=http://localhost:4444               # Hydra public API endpoint (API)
HYDRA_ADMIN_URL=http://localhost:4445                # Hydra admin API endpoint (API)
HYDRA_ADMIN_TOKEN=your_hydra_admin_token             # Bearer token for Hydra admin proxy (API)

# ─── API Gateway - Ory Oathkeeper (API) ───
OATHKEEPER_PROXY_URL=http://localhost:4455           # Oathkeeper proxy endpoint (API)
OATHKEEPER_ADMIN_URL=http://localhost:4456           # Oathkeeper admin API endpoint (API)
OATHKEEPER_ADMIN_TOKEN=your_oathkeeper_admin_token   # Bearer token for Oathkeeper admin proxy (API)

# ─── Storage - MinIO (API) ───
MINIO_CONSOLE_URL=http://localhost:9001              # MinIO web console URL (API)
MINIO_S3_ENDPOINT=http://localhost:9000              # MinIO S3 API endpoint (API)
MINIO_ACCESS_KEY=your_minio_access_key               # MinIO access key (API)
MINIO_SECRET_KEY=your_minio_secret_key               # MinIO secret key (API)

# ─── Feature Flags (flagd) ───
# FLAGD_HOST=localhost                    # flagd hostname (default: localhost for self-hosted)
# FLAGD_PORT=8013                         # flagd evaluation port
# FLAGD_URL=http://localhost:8013         # Full flagd URL (overrides HOST+PORT)

# ─── Observability (API) ───
# Metrics (/metrics) + structured JSON logs are always on. Tracing is opt-in:
# OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318   # OTLP/HTTP endpoint; unset = tracing off
# OTEL_SERVICE_NAME=truss-api                         # service name on spans
# LOG_LEVEL=info                                      # pino log level

# ─── Cache / KV - Valkey (API) ───
# VALKEY_HOST=localhost                   # Valkey hostname (default: localhost)
# VALKEY_PORT=6379                        # Valkey port
# VALKEY_PASSWORD=                        # requirepass value (empty = no auth)
# VALKEY_URL=                             # Full redis:// URL (overrides HOST+PORT+PASSWORD)

# ─── Email - SMTP (Resend / Brevo / SES) ───
SMTP_HOST=smtp.resend.com                              # SMTP host (API) — Resend: smtp.resend.com
SMTP_PORT=465                                          # SMTP port (API) — 465 for SSL, 587 for STARTTLS
SMTP_USER=resend                                       # SMTP username (API) — Resend: "resend"
SMTP_PASS=your_resend_api_key                          # SMTP password / API key (API)
SMTP_FROM=noreply@yourdomain.com                       # From address (must be verified domain) (API)

# ─── Dashboard (Vite / CF Pages) ───
# VITE_API_BASE_URL is set at build time on CF Pages, not here.
# For local dev, Vite proxies /api to localhost:8787 automatically.

# ─── Security & Access Control (API) ───
TRUSS_AUTH_REQUIRED=false                            # Require Kratos auth for dashboard access (API)
TRUSS_ADMIN_IDENTITY_IDS=                            # Comma-separated Kratos identity IDs with admin access (API)
TRUSS_DEMO_MODE=false                                # Anonymous read-only demo access via X-Demo header (rate-limited). NEVER true unless intentional public demo (API)
CORS_ALLOWED_ORIGINS=                                # Comma-separated frontend origins, e.g. https://app.yourdomain.com (API) — required when dashboard + API are on different domains
# First-boot default admin (seeded only if no identity exists). Password blank = random, printed to logs.
# TRUSS_BOOTSTRAP_ADMIN=false                        # disable first-boot admin seeding (API)
# TRUSS_BOOTSTRAP_ADMIN_EMAIL=admin@truss.local      # default admin email (API)
# TRUSS_BOOTSTRAP_ADMIN_PASSWORD=                     # set for known creds; blank = generated + logged (API)
# COOKIE_SECURE=                                     # force session-cookie Secure flag (true/false). Default: inferred from the public URL scheme (https=on, http=off), else NODE_ENV. Set false when serving over plain HTTP.
ENCRYPTION_KEY=                                      # 32+ char random string for encrypting saved connection passwords (required in production)
TRUSS_DEV_MODE=false                                 # Dev-only tenant seeding & switcher (API). NEVER true in production.
VITE_DEV_MODE=false                                  # Dev-only tenant switcher (Dashboard). NEVER true in production.

# ─── Docker Hub ───
DOCKER_USERNAME=                    # Docker Hub username
DOCKER_ACCESS_TOKEN=                # Docker Hub personal access token (read/write)
DOCKER_IMAGE_API=measutosh/truss-api
DOCKER_IMAGE_DASHBOARD=measutosh/truss-dashboard

# ─── Deployment - Coolify / Docker ───
# No vars needed here for local dev. In production:
# - API runs on Coolify/Docker (port 8787) with these env vars injected
# - Dashboard/Admin/Docs deploy to CF Pages with VITE_API_BASE_URL set there
# - Admin SPA: set VITE_DASHBOARD_URL to the dashboard origin (e.g. https://app.truss.binarysquad.org)
#   so the "Console" link points to the correct domain. Defaults to "/" for same-origin dev.