# -----------------------------------------------------------------------------
# hackerspace-management environment variables
# -----------------------------------------------------------------------------
# Copy to .env.local for development; set the same keys on your host for prod.
# .env.local is git-ignored. Never commit real secrets.
# -----------------------------------------------------------------------------

# Supabase (required)
NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOi...replace-with-anon-key

# Server-side admin key. Bypasses RLS. Required for createSpace / joinSpace.
# Treat as a secret. Never expose to the browser. Never log it.
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi...replace-with-service-role-key

# App URL (required)
# Public-facing base URL of this deployment. Used in OAuth redirects.
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Secrets vault encryption key (required for the /ops Secrets feature).
# 32 bytes of cryptographically random data, hex-encoded (64 hex chars).
# Generate with: openssl rand -hex 32
# Without this set, the secrets feature falls back to legacy plain-text storage.
# Rotating this key invalidates all existing ciphertexts; re-enter each secret.
SECRETS_ENCRYPTION_KEY=

# OAuth provider buttons on the login page (optional).
# Set to "true" only for a provider you have actually configured in Supabase
# Auth. Unset/anything-else hides that button (an unconfigured provider button
# just dead-ends in a Supabase error). If neither is "true" the whole
# "OR / social sign-in" block is hidden.
NEXT_PUBLIC_OAUTH_GITHUB=
NEXT_PUBLIC_OAUTH_GOOGLE=

# Node env (optional, defaults to "development" locally)
NODE_ENV=development

# Docker build flag (only when building the standalone image)
# Set to "1" in the Dockerfile so next.config.mjs emits standalone output.
# DOCKER_BUILD=1

# -----------------------------------------------------------------------------
# Per-space integration credentials (PayPal, Zeffy, Venmo, Stripe) are stored
# in the database under the `integrations` table, not in env. The
# /api/paypal/sync endpoint reads them from there.
# -----------------------------------------------------------------------------