.env.example

# -----------------------------------------------------------------------------
# Core application
# -----------------------------------------------------------------------------

# Session — required, minimum 32 chars, used for AES-256 cookie encryption
NUXT_SESSION_SECRET=change-me-to-a-random-32-char-string
# Optional: previous secret used during key/session secret rotation
# NUXT_SESSION_SECRET_PREVIOUS=old-random-32-char-string

# Public app URL
NUXT_PUBLIC_SITE_URL=http://localhost:3000

# Public UX/runtime flags
NUXT_PUBLIC_GITHUB_APP_SLUG=contentrain-studio
NUXT_PUBLIC_TEMPLATE_OWNER=Contentrain

# -----------------------------------------------------------------------------
# Deployment profile
# -----------------------------------------------------------------------------
#
# One of: managed | dedicated | on-premise | community
#
# When unset, Studio auto-detects the profile at boot from (a) whether the
# Enterprise bridge (ee/) loads and (b) whether any payment plugin is
# configured. The rule is:
#
#   ee/ loaded + polar/stripe env set → managed
#   ee/ loaded + no billing env       → on-premise
#   ee/ missing                       → community (regardless of billing)
#
# Set explicitly when running a dedicated single-tenant deployment (which
# auto-detects as "managed"), or to pin behaviour in staging/dev.
#
# See docs/DEPLOYMENT_PROFILES.md for the full 12-scenario matrix.
#
# NUXT_DEPLOYMENT_PROFILE=managed

# Production deploys (Nitro compiled output) freeze runtimeConfig.public,
# so the auto-derive plugin can't mutate the snapshot. Set these three
# explicitly in production to mirror the server-side resolveDeployment()
# result on the client. Dev mode (pnpm dev) doesn't need them — the
# plugin handles it. Values must match: profile + edition + billingMode.
#
# Managed SaaS example:
# NUXT_PUBLIC_DEPLOYMENT_PROFILE=managed
# NUXT_PUBLIC_DEPLOYMENT_EDITION=ee
# NUXT_PUBLIC_DEPLOYMENT_BILLING_MODE=polar
#
# Community self-host example:
# NUXT_PUBLIC_DEPLOYMENT_PROFILE=community
# NUXT_PUBLIC_DEPLOYMENT_EDITION=agpl
# NUXT_PUBLIC_DEPLOYMENT_BILLING_MODE=off

# Billing UI visibility. When unset, Studio derives this from the payment
# plugin registry at boot (true when Polar or Stripe is configured). Set
# explicitly only to override — e.g. staging without checkout, or a
# managed deployment temporarily hiding the subscription surface.
#
# NUXT_PUBLIC_BILLING_ENABLED=true

# -----------------------------------------------------------------------------
# Provider selection
# -----------------------------------------------------------------------------
#
# Auth + database providers ship as matched pairs:
#
#   supabase + supabase  (default) — Supabase Auth + Supabase PostgreSQL
#   managed  + postgres            — Studio-managed auth + plain PostgreSQL
#
# Leave unset for the Supabase pair. Mixed pairs are rejected at boot (the
# Supabase DB provider needs Supabase-issued JWTs; the managed auth provider
# issues JWTs only the Postgres provider understands).
#
# NUXT_AUTH_PROVIDER=supabase
# NUXT_DATABASE_PROVIDER=supabase
#
# Required when NUXT_DATABASE_PROVIDER=postgres:
# NUXT_POSTGRES_URL=postgres://user:password@host:5432/contentrain
#
# Required when NUXT_AUTH_PROVIDER=managed (min 32 chars, signs auth JWTs):
# NUXT_AUTH_JWT_SECRET=change-me-to-a-random-32-char-string
#
# Required when NUXT_AUTH_PROVIDER=managed — login OAuth apps (the managed
# pair runs the OAuth dance itself; callbacks point at
# {NUXT_PUBLIC_SITE_URL}/api/auth/oauth/{github,google}).
# Google is optional (sign-in button hidden when unset).
# NUXT_OAUTH_GITHUB_CLIENT_ID=your-github-oauth-app-client-id
# NUXT_OAUTH_GITHUB_CLIENT_SECRET=your-github-oauth-app-client-secret
# NUXT_OAUTH_GOOGLE_CLIENT_ID=your-google-oauth-client-id
# NUXT_OAUTH_GOOGLE_CLIENT_SECRET=your-google-oauth-client-secret
#
# Required in deployed builds (min 32 chars) — session store for the
# nuxt-auth-utils OAuth module. Separate from NUXT_SESSION_SECRET; stores no
# durable state (rotate freely). Dev auto-generates it; production builds
# without it 500 ("Empty password") on every SSR load of /api/_auth/session.
# NUXT_SESSION_PASSWORD=change-me-to-a-random-32-char-string
#
# Note: NUXT_RESEND_API_KEY (Email section below) is REQUIRED when
# NUXT_AUTH_PROVIDER=managed — magic-link + invite emails go through Resend.

# -----------------------------------------------------------------------------
# GitHub
# -----------------------------------------------------------------------------

# GitHub App (repository access, installation lifecycle, repo scan/create)
NUXT_GITHUB_APP_ID=your-app-id
NUXT_GITHUB_CLIENT_ID=your-client-id
NUXT_GITHUB_CLIENT_SECRET=your-client-secret
NUXT_GITHUB_PRIVATE_KEY=base64-encoded-pem-file
NUXT_GITHUB_WEBHOOK_SECRET=your-hmac-webhook-secret

# Supabase Auth OAuth provider config (used by local Supabase auth)
SUPABASE_AUTH_EXTERNAL_GITHUB_CLIENT_ID=your-github-oauth-client-id
SUPABASE_AUTH_EXTERNAL_GITHUB_SECRET=your-github-oauth-client-secret
SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID=your-google-oauth-client-id
SUPABASE_AUTH_EXTERNAL_GOOGLE_SECRET=your-google-oauth-client-secret

# -----------------------------------------------------------------------------
# AI
# -----------------------------------------------------------------------------

# Optional: Studio-hosted Anthropic key. If omitted, users need BYOA where enabled.
NUXT_ANTHROPIC_API_KEY=your-anthropic-api-key

# -----------------------------------------------------------------------------
# Supabase
# -----------------------------------------------------------------------------

NUXT_SUPABASE_URL=https://your-project.supabase.co
NUXT_SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
NUXT_SUPABASE_ANON_KEY=your-anon-key

# -----------------------------------------------------------------------------
# CDN / object storage
# -----------------------------------------------------------------------------

# Optional: required for CDN/media delivery surfaces
NUXT_CDN_R2_ACCOUNT_ID=your-cloudflare-account-id
NUXT_CDN_R2_ACCESS_KEY_ID=your-r2-access-key-id
NUXT_CDN_R2_SECRET_ACCESS_KEY=your-r2-secret-access-key
NUXT_CDN_R2_BUCKET=contentrain-cdn

# -----------------------------------------------------------------------------
# Email
# -----------------------------------------------------------------------------

# Resend is used by the app for invite reminders and notifications.
# Supabase local auth SMTP also reads RESEND_API_KEY from supabase/config.toml.
NUXT_RESEND_API_KEY=re_your-resend-api-key
RESEND_API_KEY=re_your-resend-api-key
NUXT_EMAIL_SENDER_ADDRESS=noreply@example.com
NUXT_EMAIL_SENDER_NAME=Contentrain Studio

# -----------------------------------------------------------------------------
# Billing — Polar (default provider)
# -----------------------------------------------------------------------------

# Optional: when all Polar + Stripe vars are omitted, Studio auto-resolves
# to the on-premise profile (ee/ loaded) or community profile (ee/ missing)
# and hides the subscription UI entirely. See docs/PAYMENT_PROVIDERS.md for
# Polar dashboard + meter setup and docs/DEPLOYMENT_PROFILES.md for the
# profile × env matrix.
NUXT_POLAR_ACCESS_TOKEN=polar_oat_your-organization-access-token
NUXT_POLAR_WEBHOOK_SECRET=your-polar-webhook-signing-secret
NUXT_POLAR_STARTER_PRODUCT_ID=uuid-of-starter-product
NUXT_POLAR_PRO_PRODUCT_ID=uuid-of-pro-product
# 'sandbox' for Polar sandbox environment; 'production' for live.
NUXT_POLAR_SERVER=sandbox

# -----------------------------------------------------------------------------
# Billing — Stripe (legacy / optional)
# -----------------------------------------------------------------------------

# Optional: Stripe is still supported as a secondary payment plugin. When both
# Polar and Stripe are configured, Polar takes precedence (see registry).
# NUXT_STRIPE_SECRET_KEY=sk_test_your-stripe-secret-key
# NUXT_STRIPE_WEBHOOK_SECRET=whsec_your-webhook-signing-secret
# NUXT_STRIPE_STARTER_PRICE_ID=price_starter-monthly-id
# NUXT_STRIPE_PRO_PRICE_ID=price_pro-monthly-id

# -----------------------------------------------------------------------------
# Redis
# -----------------------------------------------------------------------------

# Optional but strongly recommended for multi-instance production rate limiting.
# Development falls back to in-memory rate limiting when REDIS_URL is unset.
REDIS_URL=redis://localhost:6379
# REDIS_CA_CERT=/etc/ssl/certs/redis-ca.pem

# -----------------------------------------------------------------------------
# Sentry — error & performance monitoring (optional)
# -----------------------------------------------------------------------------
#
# Leave NUXT_PUBLIC_SENTRY_DSN empty to disable Sentry entirely: the SDK becomes
# a no-op on both client and server and NO telemetry leaves your infrastructure.
# This is the intended Community / self-host default. Set it to your OWN Sentry
# project's DSN to enable error + performance reporting.
#
# NUXT_PUBLIC_SENTRY_DSN=https://<key>@<org-id>.ingest.<region>.sentry.io/<project-id>
# NUXT_PUBLIC_SENTRY_ENVIRONMENT=production   # development | staging | production
# NUXT_PUBLIC_SENTRY_TRACES_SAMPLE_RATE=0.1   # perf-tracing sample; errors are always 100%
# NUXT_PUBLIC_SENTRY_RELEASE=                 # optional build/release identifier

# Build-time only — source map upload (optional). When all three are set during
# `nuxt build`, readable stack traces are uploaded to Sentry. Leave unset to skip
# upload (the build still succeeds). SENTRY_AUTH_TOKEN is a secret — never expose
# it to forked CI or the client bundle.
# SENTRY_ORG=your-sentry-org-slug
# SENTRY_PROJECT=your-sentry-project-slug
# SENTRY_AUTH_TOKEN=your-sentry-auth-token