.env.example

# ============================================
# Nebutra-Sailor Environment Variables
# Copy this file to .env and fill in the values
# ============================================

# ============================================
# Database (Supabase)
# ============================================
DATABASE_URL="postgresql://postgres:postgres@localhost:5432/nebutra?schema=public"
DIRECT_URL="postgresql://postgres:postgres@localhost:5432/nebutra?schema=public"

# Supabase (Production)
# SUPABASE_URL="https://your-project.supabase.co"
# SUPABASE_ANON_KEY="your-anon-key"
# SUPABASE_SERVICE_ROLE_KEY="your-service-role-key"

# ============================================
# Redis (Upstash)
# ============================================
UPSTASH_REDIS_REST_URL="http://localhost:6379"
UPSTASH_REDIS_REST_TOKEN=""
# Status page (apps/landing) — durable 90-day bars + incident write API.
# Reuses Upstash REST above when set. Without it, history is process-local only.
# STATUS_ADMIN_TOKEN=""   # min 16 chars; Bearer for POST /api/status/incidents
# Local/BullMQ-compatible Redis URL. Some scripts also use this as a stub value
# while exporting runtime contracts.
REDIS_URL="redis://localhost:6379"

# ============================================
# Authentication
# ============================================
# Selects which provider @nebutra/auth instantiates.
# Values: "better-auth" (self-hosted, default) | "nextauth" | "clerk" | "supabase" | "dev"
AUTH_PROVIDER="better-auth"
NEXT_PUBLIC_AUTH_PROVIDER="better-auth"

# Early-access gate. Keep server/client values mirrored so server route guards
# and client-side form fields agree.
ACCESS_GATE_MODE="open"                # "open" | "invite" | "waitlist"
NEXT_PUBLIC_ACCESS_GATE_MODE="open"

# --- Better Auth (self-hosted — uses the Postgres from DATABASE_URL) ---
# Generate with: openssl rand -base64 32
BETTER_AUTH_SECRET=""
# Base URL where /api/auth/* is served (e.g. https://your-domain.com)
BETTER_AUTH_URL=""
# Google OAuth / One Tap shared by Better Auth and NextAuth
GOOGLE_CLIENT_ID=""
GOOGLE_CLIENT_SECRET=""
# - Better Auth uses the same GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET pair and
#   its official one-tap plugin under /api/auth/one-tap/callback.
# - The landing app needs NEXT_PUBLIC_GOOGLE_CLIENT_ID set to the same web
#   client id when NEXT_PUBLIC_AUTH_PROVIDER="better-auth" or "nextauth".
NEXT_PUBLIC_GOOGLE_CLIENT_ID=""
# Other optional Better Auth OAuth social providers
GITHUB_CLIENT_ID=""
GITHUB_CLIENT_SECRET=""
# Sign in with Apple — App Store compliance for any SaaS that ships Google/Facebook login.
# Apple's client_secret is a short-lived JWT signed with the .p8 key from Apple Developer.
APPLE_CLIENT_ID=""
APPLE_CLIENT_SECRET=""
# Microsoft Entra ID (formerly Azure AD) — required for enterprise / EDU customers.
MICROSOFT_CLIENT_ID=""
MICROSOFT_CLIENT_SECRET=""
# Feishu/Lark SSO via Better Auth generic OAuth.
# Feishu developer console redirect URI:
#   https://app.nebutra.com/api/auth/oauth2/callback/feishu
FEISHU_APP_ID=""
FEISHU_APP_SECRET=""
FEISHU_OAUTH_SCOPES="contact:user.email contact:user.base:readonly"
FEISHU_ALLOWED_TENANT_KEYS=""
FEISHU_REDIRECT_URI=""

# --- NextAuth / Auth.js v5 (self-hosted OAuth ecosystem) ---
# Generate with: openssl rand -base64 32
AUTH_SECRET=""
NEXTAUTH_URL="http://localhost:3001"
# Enables Google Identity Services One Tap on the landing app.
# NextAuth's custom callback requires this redirect URI in Google Cloud:
#   https://app.nebutra.com/api/auth/google-one-tap
# as an authorized redirect URI for the OAuth web client.
NEXT_PUBLIC_ENABLE_GOOGLE_ONE_TAP="true"
NEBUTRA_LANDING_ORIGIN="https://nebutra.com"
NEBUTRA_SESSION_HINT_DOMAIN=".nebutra.com"

# --- Clerk (managed — only set if NEXT_PUBLIC_AUTH_PROVIDER="clerk") ---
# Clerk Google One Tap is driven by Clerk's official <GoogleOneTap /> component;
# it uses the Clerk publishable key, not NEXT_PUBLIC_GOOGLE_CLIENT_ID.
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=""
CLERK_SECRET_KEY=""
NEXT_PUBLIC_CLERK_SIGN_IN_URL="/sign-in"
NEXT_PUBLIC_CLERK_SIGN_UP_URL="/sign-up"
NEXT_PUBLIC_CLERK_AFTER_SIGN_IN_URL="/dashboard"
NEXT_PUBLIC_CLERK_AFTER_SIGN_UP_URL="/dashboard"
# Enterprise SSO domain discovery for the web app. Clerk entries use the
# built-in /sign-in/sso handoff; Feishu entries use /api/auth/oauth/feishu;
# generic entries must define loginUrl.
# AUTH_SSO_DISCOVERY_PROVIDERS='[{"domain":"nebutra.com","id":"nebutra-entra","name":"Nebutra Entra ID","type":"oidc","provider":"clerk"}]'
# AUTH_SSO_DISCOVERY_PROVIDERS='[{"domain":"example.cn","id":"example-feishu","name":"Example Feishu","type":"oidc","provider":"feishu"}]'
AUTH_SSO_DISCOVERY_PROVIDERS=""

# --- Nebutra-owned OIDC issuer (apps/idp, sso.nebutra.com) ---
# This is separate from enterprise SSO discovery above. It makes Nebutra an
# issuer for first-party/internal relying parties.
OIDC_ISSUER="https://sso.nebutra.com"
# Generate two or more high-entropy keys with:
#   openssl rand -base64 48
OIDC_COOKIE_KEYS=""
OIDC_ENABLE_CLIENT_CREDENTIALS="false"

# ============================================
# Community / Forum (Discourse)
# ============================================
# The "discourse connect secret" set in Discourse admin settings
DISCOURSE_SSO_SECRET="your_discourse_sso_secret_here"
# The URL of your Discourse instance
DISCOURSE_URL="https://forum.yourdomain.com"

# ============================================
# AI Services (@nebutra/agents)
# ============================================
# At least one AI provider key is required for /chat and agent features.
# OpenRouter recommended — 300+ models, automatic failover.
OPENROUTER_API_KEY=""
OPENAI_API_KEY=""
# SiliconFlow (China-optimized, OpenAI-compatible)
# SILICONFLOW_API_KEY=""
# SenseNova Token Plan (OpenAI-compatible)
# Docs: https://platform.sensenova.cn/docs
#       https://github.com/OpenSenseNova/SenseNova6.7/blob/main/API_CN.md
# Base: https://token.sensenova.cn/v1  (NOT api.sensenova.cn)
# Small models: sensenova-6.7-flash-lite | deepseek-v4-flash
# SENSENOVA_API_KEY=""
# SENSENOVA_BASE_URL="https://token.sensenova.cn/v1"
# Google Vertex AI (optional)
# GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials.json"
# GOOGLE_VERTEX_PROJECT=""
# GOOGLE_VERTEX_LOCATION="us-central1"

# ============================================
# Payments & Billing (Stripe)
# ============================================
STRIPE_SECRET_KEY="sk_test_xxx"
STRIPE_WEBHOOK_SECRET="whsec_xxx"
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY="pk_test_xxx"

# Stripe Price IDs (create in Stripe Dashboard)
STRIPE_PRICE_ID_PRO_MONTHLY="price_xxx"
STRIPE_PRICE_ID_PRO_YEARLY="price_xxx"
STRIPE_PRICE_ID_ENTERPRISE_MONTHLY="price_xxx"
STRIPE_PRICE_ID_ENTERPRISE_YEARLY="price_xxx"
STRIPE_PRICE_ID_STARTUP_LICENSE="price_xxx"

# ============================================
# Email (@nebutra/email)
# ============================================
# Provider auto-detection: RESEND_API_KEY → resend | SMTP_HOST → nodemailer | fallback → console
# EMAIL_PROVIDER=""                    # "resend" | "nodemailer" | "console" (auto-detect if empty)
EMAIL_FROM="Nebutra <noreply@nebutra.com>"
RESEND_API_KEY=""
# SMTP (Nodemailer — self-hosted fallback)
# SMTP_HOST=""
# SMTP_PORT="587"
# SMTP_USER=""
# SMTP_PASS=""
# SMTP_SECURE="false"
# Contact form recipient (defaults to contact@nebutra.com if unset)
CONTACT_FORM_TO=""
# ICP 备案号 — required for websites operated in mainland China.
# Format: 苏ICP备XXXXXXXX号  (leave empty outside China)
NEXT_PUBLIC_ICP_NUMBER=""

# ============================================
# E-commerce (Shopify)
# ============================================
SHOPIFY_API_KEY=""
SHOPIFY_API_SECRET=""
SHOPIFY_SCOPES="read_products,write_products,read_orders"

# ============================================
# Web3
# ============================================
ALCHEMY_API_KEY=""
# Or Infura
# INFURA_API_KEY=""

# ============================================
# Inngest (Background Jobs)
# ============================================
INNGEST_EVENT_KEY=""
INNGEST_SIGNING_KEY=""

# ============================================
# Message Queue (@nebutra/queue)
# ============================================
# Provider auto-detection: QSTASH_TOKEN → qstash | REDIS_URL → bullmq | fallback → memory
# Override with: QUEUE_PROVIDER="qstash" | "bullmq" | "memory"
QUEUE_PROVIDER=""

# Upstash QStash (serverless queue — zero infra)
QSTASH_TOKEN=""
QSTASH_CURRENT_SIGNING_KEY=""
QSTASH_NEXT_SIGNING_KEY=""
QSTASH_CALLBACK_BASE_URL=""                     # e.g. https://api.nebutra.com

# BullMQ uses REDIS_URL from the Redis section above — no extra config needed
# Bull Board dashboard: http://localhost:3200 (docker-compose profile: queue)

# ============================================
# Full-Text Search (@nebutra/search)
# ============================================
# Provider auto-detection: MEILISEARCH_URL → meilisearch | TYPESENSE_URL → typesense | ALGOLIA_APP_ID → algolia
SEARCH_PROVIDER=""
MEILISEARCH_URL="http://localhost:7700"
MEILISEARCH_API_KEY="nebutra-dev-key"
# TYPESENSE_URL="http://localhost:8108"
# TYPESENSE_API_KEY=""
# ALGOLIA_APP_ID=""
# ALGOLIA_SEARCH_KEY=""
# ALGOLIA_ADMIN_KEY=""

# ============================================
# Notifications (@nebutra/notifications)
# ============================================
# Provider auto-detection: NOVU_API_KEY → novu | fallback → direct
NOVU_API_KEY=""
NOVU_APP_ID=""

# ============================================
# Permissions (@nebutra/permissions)
# ============================================
# Provider auto-detection: OPENFGA_API_URL → openfga | fallback → casl
# OPENFGA_API_URL="http://localhost:8080"
# OPENFGA_STORE_ID=""

# ============================================
# Webhooks (@nebutra/webhooks)
# ============================================
# Provider auto-detection: SVIX_API_KEY → svix | fallback → custom
SVIX_API_KEY=""

# ============================================
# Metering (@nebutra/metering)
# ============================================
# Uses CLICKHOUSE_HTTP_URL from Warehouse section — no extra config needed
# Memory fallback if ClickHouse not available

# ============================================
# Uploads (@nebutra/uploads)
# ============================================
# Provider auto-detection: BLOB_READ_WRITE_TOKEN → blob | R2 → s3 | AWS → s3 | fallback → local
# UPLOAD_PROVIDER=""                   # "blob" | "s3" | "local" (auto-detect if empty)
BLOB_READ_WRITE_TOKEN=""               # Vercel Blob (zero-config on Vercel, auto-provisioned)
# UPLOAD_DIR="/tmp/nebutra-uploads"    # Local provider only

# ============================================
# Pebble support intake (api.nebutra.com/pebble/*)
# ============================================
# Signs the 10-minute, single-use diagnostic upload tokens. Falls back to
# SERVICE_SECRET when unset, so a deployment never signs with a known value.
# PEBBLE_DIAGNOSTICS_TOKEN_SECRET=""   # min 32 chars: openssl rand -hex 32
# Private bucket for diagnostic bundles. Objects must not be public and must
# expire in step with the 30-day retention sweep.
# PEBBLE_DIAGNOSTICS_BUCKET="nebutra-pebble-diagnostics"

# ============================================
# Vault (@nebutra/vault)
# ============================================
# Provider auto-detection: AWS_KMS_KEY_ID → aws-kms | VAULT_MASTER_KEY → local
VAULT_MASTER_KEY=""                    # 32+ char secret for local envelope encryption
# AWS_KMS_KEY_ID=""                    # AWS KMS CMK ID for production

# ============================================
# Multi-Tenancy (@nebutra/tenant)
# ============================================
# TENANT_ISOLATION_STRATEGY="shared_schema"  # shared_schema | schema_per_tenant | database_per_tenant
# TENANT_HEADER_NAME="x-tenant-id"

# ============================================
# Observability
# ============================================
# Sentry
SENTRY_DSN=""
NEXT_PUBLIC_SENTRY_DSN=""
SENTRY_AUTH_TOKEN=""
SENTRY_ORG=""
SENTRY_PROJECT=""
LOGGER_SENTRY_ENABLED="false"

# PostHog
POSTHOG_KEY=""
POSTHOG_HOST="https://us.i.posthog.com"
NEXT_PUBLIC_POSTHOG_KEY=""
NEXT_PUBLIC_POSTHOG_HOST="https://us.i.posthog.com"
# Product telemetry toggles. Set to "0" or "false" to disable emission.
NEBUTRA_TELEMETRY="true"
NEXT_PUBLIC_NEBUTRA_TELEMETRY="true"
# Optional Nebutra-specific aliases accepted by gateway webhook analytics.
NEBUTRA_POSTHOG_KEY=""
NEBUTRA_POSTHOG_HOST=""

# OpenTelemetry
OTEL_ENABLED="false"
OTEL_EXPORTER_OTLP_ENDPOINT=""
OTEL_EXPORTER_OTLP_HEADERS=""
OTEL_SERVICE_NAME="nebutra-sailor"
# Fraction of traces to export: 0.0–1.0 (default: 0.1 in prod, 1.0 in dev)
OTEL_SAMPLE_RATE="0.1"
# Set in CI/CD to link Sentry errors to deploys: "1.2.3+abc1234"
SENTRY_RELEASE=""

# ============================================
# URLs
# ============================================
# Public URLs (used by frontend)
NEXT_PUBLIC_SITE_URL="http://localhost:3000"           # Production: https://nebutra.com
NEXT_PUBLIC_APP_URL=https://app.nebutra.com
NEXT_PUBLIC_API_URL=https://api.nebutra.com
NEXT_PUBLIC_STUDIO_URL="http://localhost:3003"         # Production: https://studio.nebutra.com
NEXT_PUBLIC_COMMUNITY_URL="https://github.com/Nebutra"

# Internal URLs (server-side only)
LANDING_URL="http://localhost:3000"
WEB_URL="http://localhost:3001"
API_GATEWAY_URL="http://localhost:3002"
STUDIO_URL="http://localhost:3003"

# Microservice URLs (internal) — only `ai` runs out-of-process (ML/LLM batch)
AI_SERVICE_URL="http://localhost:8001"

# Warehouse (ClickHouse)
CLICKHOUSE_HTTP_URL="http://localhost:8123"
CLICKHOUSE_DATABASE="nebutra"
CLICKHOUSE_USER="default"
CLICKHOUSE_PASSWORD=""
DEFAULT_DASHBOARD_TENANT_ID="demo_org"

# ============================================
# CMS (Sanity)
# ============================================
NEXT_PUBLIC_SANITY_PROJECT_ID="wyfqr24v"
NEXT_PUBLIC_SANITY_DATASET="production"
NEXT_PUBLIC_SANITY_API_VERSION="2024-01-01"
SANITY_API_TOKEN=""

# ============================================
# Cloudflare
# ============================================
CLOUDFLARE_ACCOUNT_ID=""
CLOUDFLARE_API_TOKEN=""

# R2 Storage
R2_ACCESS_KEY_ID=""
R2_SECRET_ACCESS_KEY=""
R2_BUCKET_ASSETS="nebutra-assets"
R2_BUCKET_UPLOADS="nebutra-uploads"
R2_BUCKET_BACKUPS="nebutra-backups"
R2_PUBLIC_URL="https://cdn.nebutra.com"       # Production CDN URL

# Turnstile (CAPTCHA)
NEXT_PUBLIC_TURNSTILE_SITE_KEY=""             # Public site key
TURNSTILE_SECRET_KEY=""                       # Server-side secret

# ============================================
# OpenStatus (Monitoring & Status Page)
# ============================================
OPENSTATUS_API_TOKEN=""
OPENSTATUS_PAGE_SLUG="nebutra"

# Alerting
SLACK_WEBHOOK_URL=""
DISCORD_WEBHOOK_URL=""

# ============================================
# Turborepo Remote Cache
# Required in CI; optional for local dev (local file cache is used by default)
# Get TURBO_TOKEN from: https://vercel.com/account/tokens
# Get TURBO_TEAM from:  https://vercel.com/account -> Team slug
# ============================================
TURBO_TOKEN=""
TURBO_TEAM=""

# ============================================
# China Compliance (@nebutra/china-compliance)
# ============================================
# WeChat OAuth (for mainland China users)
# NEXT_PUBLIC_WECHAT_APP_ID=""
# WECHAT_APP_SECRET=""
# Region auto-detection override
# NEBUTRA_REGION=""                    # "cn" | "global" (auto-detected if empty)

# ============================================
# Cron Jobs (Vercel Cron)
# ============================================
# Secret for authenticating scheduled job requests
# Generate with: openssl rand -base64 32
CRON_SECRET=""

# ============================================
# Misc
# ============================================
NODE_ENV="development"
LOG_LEVEL="debug"

# E2E controls
PLAYWRIGHT_BASE_URL="http://127.0.0.1:3100"
E2E_SKIP_CMS="false"
E2E_FAIL_ON_PREWARM="false"