############################################################
# Single source of truth for the whole stack.
#   cp .env.example .env
#
# Used by BOTH docker-compose.yml (Supabase backend) and the
# apps (Payload CMS + Astro).
#
# ⚠️  These are INSECURE DEV DEFAULTS. Regenerate every secret
#     before deploying anywhere real. See README "Production".
############################################################

########################
# Postgres (Supabase DB)
########################
POSTGRES_HOST=db
POSTGRES_DB=postgres
POSTGRES_PORT=5432
POSTGRES_PASSWORD=postgres

########################
# JWT / API keys
# The ANON_KEY and SERVICE_ROLE_KEY below are signed with this
# exact JWT_SECRET. If you change JWT_SECRET you MUST regenerate
# both keys (see README) or Auth/Kong will reject them.
########################
JWT_SECRET=your-super-secret-jwt-token-with-at-least-32-characters-long
JWT_EXPIRY=3600
ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE
SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q

# New-style opaque API keys (optional; leave blank to disable)
SUPABASE_PUBLISHABLE_KEY=
SUPABASE_SECRET_KEY=
ANON_KEY_ASYMMETRIC=
SERVICE_ROLE_KEY_ASYMMETRIC=

########################
# API gateway (Kong) + public URLs
########################
KONG_HTTP_PORT=8000
KONG_HTTPS_PORT=8443
SUPABASE_PUBLIC_URL=http://localhost:8000
API_EXTERNAL_URL=http://localhost:8000/auth/v1

########################
# Studio dashboard
########################
DASHBOARD_USERNAME=supabase
DASHBOARD_PASSWORD=this_password_is_insecure_and_should_be_updated
STUDIO_DEFAULT_ORGANIZATION=Default Organization
STUDIO_DEFAULT_PROJECT=cdrdpyj
PG_META_CRYPTO_KEY=your-encryption-key-32-chars-min
OPENAI_API_KEY=

########################
# Auth (GoTrue)
########################
SITE_URL=https://web.localhost
ADDITIONAL_REDIRECT_URLS=
DISABLE_SIGNUP=false
ENABLE_EMAIL_SIGNUP=true
ENABLE_EMAIL_AUTOCONFIRM=true
ENABLE_ANONYMOUS_USERS=false
ENABLE_PHONE_SIGNUP=false
ENABLE_PHONE_AUTOCONFIRM=false
MAILER_URLPATHS_CONFIRMATION="/auth/v1/verify"
MAILER_URLPATHS_INVITE="/auth/v1/verify"
MAILER_URLPATHS_RECOVERY="/auth/v1/verify"
MAILER_URLPATHS_EMAIL_CHANGE="/auth/v1/verify"
SMTP_ADMIN_EMAIL=admin@example.com
SMTP_HOST=supabase-mail
SMTP_PORT=2500
SMTP_USER=fake_mail_user
SMTP_PASS=fake_mail_password
SMTP_SENDER_NAME=fake_sender

########################
# REST (PostgREST)
########################
PGRST_DB_SCHEMAS=public,graphql_public
PGRST_DB_MAX_ROWS=1000
PGRST_DB_EXTRA_SEARCH_PATH=public

########################
# Storage + imgproxy
########################
GLOBAL_S3_BUCKET=stub
REGION=stub
STORAGE_TENANT_ID=stub
S3_PROTOCOL_ACCESS_KEY_ID=625729a08b95bf1b7ff351a663f3a23c
S3_PROTOCOL_ACCESS_KEY_SECRET=850181e4652dd023b7a98c58ae0d2d34bd487ee0cc3254aed6eda37307425907
IMGPROXY_AUTO_WEBP=true

############################################################
# Applications
############################################################

########################
# Payload CMS (apps/cms)
# Runs on plain http://localhost:3000 in host dev so Astro's
# server-side fetch stays plain HTTP (portless HTTPS certs are
# not trusted by Node). DATABASE_URI connects via the published
# Postgres port; the compose `apps` profile overrides host->db.
########################
DATABASE_URI=postgresql://postgres:postgres@localhost:5432/postgres
PAYLOAD_SECRET=dev-only-change-me-6f1c2b8a9e4d
PAYLOAD_PUBLIC_SERVER_URL=http://localhost:3000

########################
# Astro (apps/web) — runs behind portless at https://web.localhost
# Where the frontend reads content from Payload's REST API.
# Vars prefixed PUBLIC_ are exposed to the browser by Astro.
########################
PUBLIC_PAYLOAD_API_URL=http://localhost:3000/api
PUBLIC_SUPABASE_URL=http://localhost:8000
PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE