.env.sample

# Local development env file template.
#
# Save your filled-in copy at ~/secrets/terraso-backend/.env (NOT inside this
# repo). The Makefile and docker-compose.base.yml resolve env_file paths
# against $HOME/secrets/terraso-backend/.env.  Keeping the file outside the
# repo tree limits what AI assistants and other tools can read while browsing
# the project.
#
# One-time setup:
#   mkdir -p ~/secrets/terraso-backend
#   cp .env.sample ~/secrets/terraso-backend/.env
#   # then edit values

ENV=development
DEBUG=True
PORT=8000
WEB_CONCURRENCY=2
GUNICORN_CMD_ARGS=--worker-class gthread --threads 8
SECRET_KEY=super-sekret-that-must-be-changed-on-serious-environments
DATABASE_URL=postgres://postgres:postgres@db:5432/terraso_backend
DATABASE_EXTERNAL_PORT=5432
# Soil ID database: set SOIL_ID_DATABASE_ENABLED=false to skip starting the
# soil-id-db container entirely. Saves ~2 GB download and avoids pulling the
# container image. US soil matching still works; only global (HWSD) lookups
# need it. Default is true (included via Makefile).
# SOIL_ID_DATABASE_ENABLED=false
SOIL_ID_DATABASE_URL=postgres://postgres:postgres@soil-id-db:5432/soil_id
SOIL_ID_DATABASE_EXTERNAL_PORT=5433
ALLOWED_HOSTS=*
PYTHONBREAKPOINT=ipdb.set_trace

WEB_CLIENT_DOMAIN=127.0.0.1
WEB_CLIENT_PORT=3000
WEB_CLIENT_PROTOCOL=http
CORS_ORIGIN_WHITELIST=http://127.0.0.1:3000
API_ENDPOINT=http://127.0.0.1:8000

AIRTABLE_API_KEY=your-key-here

GOOGLE_CLIENT_ID=client-id
GOOGLE_CLIENT_SECRET=client-secret

APPLE_KEY_ID=your-apple-key-id
APPLE_TEAM_ID=your-apple-team-id
APPLE_PRIVATE_KEY=your-apple-private-key
APPLE_CLIENT_ID=your-apple-client-id

MICROSOFT_CLIENT_ID=client-id
MICROSOFT_CLIENT_SECRET=client-secret
MICROSOFT_PRIVATE_KEY=private_key
MICROSOFT_CERIFICATE_THUMBPRINT=thumbprint

JWT_SECRET=superinsecuresecretchangeit
# Access tokens are short-lived bearer credentials; clients refresh on 401.
JWT_ACCESS_EXP_DELTA_SECONDS=7200
# Refresh tokens are rotated on each use, so this is a rolling cap on
# inactivity, not absolute session lifetime.
JWT_REFRESH_EXP_DELTA_SECONDS=2592000

PROFILE_IMAGES_S3_BUCKET=terraso-dev-profile-images-332486111078-us-east-1-an
PROFILE_IMAGES_BASE_URL=images.dev.terraso.org
STORY_MAP_MEDIA_S3_BUCKET=terraso-dev-files-332486111078-us-east-1-an
STORY_MAP_MEDIA_BASE_URL=files.dev.terraso.org
DATA_ENTRY_FILE_S3_BUCKET=terraso-dev-files-332486111078-us-east-1-an
DATA_ENTRY_FILE_BASE_URL=files.dev.terraso.org

DB_BACKUP_S3_BUCKET=backup.dev.terraso.org
ALLOW_RESTORE_FROM_BACKUP=false
DB_RESTORE_CONFIG_FILE=/etc/terraso/restore.conf
AWS_ACCESS_KEY_ID=aws-key-id
AWS_SECRET_ACCESS_KEY=aws-secret-access-key
# Set this to "virtual" for account-private S3 bucket names (no dots in name).
# Legacy bucket names with dots (e.g. files.terraso.net) must leave this empty
# so boto3 auto-detects path-style. See settings.py for details.
# AWS_S3_ADDRESSING_STYLE=virtual

AWS_SES_ACCESS_KEY_ID=aws-key-id
AWS_SES_SECRET_ACCESS_KEY=aws-secret-access-key

CDN_STATIC_S3_BUCKET=set-me-for-prod
CDN_STATIC_DOMAIN=set-me-for-prod
PLAUSIBLE_URL=https://plausible.io/api/event
RENDER_API_TOKEN=your-render-token

GOOGLE_ANDROID_CLIENT_ID=google-mobile-client-id
GOOGLE_IOS_CLIENT_ID=google-mobile-client-id

MAPBOX_USERNAME=mapbox-username
MAPBOX_ACCESS_TOKEN=your-mapbox-token

# Uncomment and populate with a DSN to enable Sentry.
# SENTRY_DSN=https://xyz.ingest.sentry.io/abcd

HUBSPOT_PORTAL_ID=98765
HUBSPOT_ACCOUNT_DELETION_FORM_ID=hubspot-form-uuid
HUBSPOT_AUTH_TOKEN="pat-xxxxxxx"

# Export system - controls pagination size for GraphQL queries in export endpoints
# you may want to use 1 for testing purposes to make sure pagination working correctly
EXPORT_PAGE_SIZE=50

# Controls verbosity of GraphQL operation logging in development. Only active when ENV="development".
# "minimal" - default Django structlog logging (no GraphQL-specific info)
# "names"   - include GraphQL operation name in request_started/request_finished logs
# "full"    - also include input variables (request_started) and response (request_finished)
GRAPHQL_LOG_LEVEL="names"

# PostHog product analytics (server-side). Disabled unless POSTHOG_ENABLED is
# true AND POSTHOG_API_KEY is set. Use the same project key as the mobile client.
POSTHOG_API_KEY=
POSTHOG_HOST=https://us.i.posthog.com
POSTHOG_ENABLED=false

# Generally use True in local .env to not create real tickets.
# Default False in production & staging.
HUBSPOT_DRY_RUN=True