DATABASE_URL="postgresql://postgres:example-PAssw0rd-xHjDYR.b7N@db:5432/postgres"
REDIS_URL="redis://localhost:6379"

BETTER_AUTH_SECRET=""

AUTH_GOOGLE_CLIENT_ID=""
AUTH_GOOGLE_CLIENT_SECRET=""

AUTH_GITHUB_CLIENT_ID=""
AUTH_GITHUB_CLIENT_SECRET=""

STRIPE_SECRET_KEY=""
STRIPE_WEBHOOK_SECRET=""

API_SERVER_URL=""

# Comma-separated browser origins for CORS (/api/*) and Stripe return URLs.
# Required when the Capacitor dev server uses a LAN IP (see ios/App/App/capacitor.config.json),
# e.g. ADDITIONAL_TRUSTED_ORIGINS="https://10.0.0.129:5273,https://198.18.0.1:5273"

# OTEL_EXPORTER_OTLP_ENDPOINT="http://localhost:4318"

# Master key for the in-process LLM/TTS router envelope crypto.
# Base64 of 32 random bytes. Required at boot: missing or wrong-length value
# fails env parsing and the server refuses to start (no graceful skip).
# Do NOT commit a real key here — put the value in `.env.local` (gitignored).
#
# Generate:
#   openssl rand -base64 32
#
# Rotation: when replacing the key, copy the old value to
# LLM_ROUTER_MASTER_KEY_PREVIOUS first, set LLM_ROUTER_MASTER_KEY to the new
# one, redeploy, then run a re-wrap of every stored ciphertext before
# dropping PREVIOUS. See `apps/server/src/utils/envelope-crypto.ts`.
LLM_ROUTER_MASTER_KEY=""
# LLM_ROUTER_MASTER_KEY_PREVIOUS=""