.env.example

# codeforphilly-rewrite — local development environment
# Copy this file to .env and fill in values for your machine.
# Lines starting with # are comments. Never commit your .env.

# ---------------------------------------------------------------------------
# Core
# ---------------------------------------------------------------------------

# TCP port the Fastify API listens on.
PORT=3001

# Runtime mode. Controls logger format, cookie Secure flag, CORS permissiveness.
# One of: development | test | production
NODE_ENV=development

# ---------------------------------------------------------------------------
# Public gitsheets data repo
# ---------------------------------------------------------------------------

# Path to the codeforphilly-data working tree. Relative paths are resolved
# from the API workspace dir (`apps/api/`) — prefer absolute paths in dev.
# Bootstrap a fresh dev data repo with the sheet configs the API needs:
#   npm run -w apps/api script:setup-dev-data
# (Uses this CFP_DATA_REPO_PATH; creates the directory + git repo + .gitsheets/<sheet>.toml.)
# In production, point at a clone of https://github.com/CodeForPhilly/codeforphilly-data.
CFP_DATA_REPO_PATH=../codeforphilly-data

# Git remote URL to push public data commits to. Optional in dev; required in prod.
# This is the production private data repo — the public snapshot is published separately.
# CFP_DATA_REMOTE=git@github.com:CodeForPhilly/codeforphilly-data.git

# ---------------------------------------------------------------------------
# Private storage
# ---------------------------------------------------------------------------

# Which private-storage backend to use. Use 'filesystem' for local dev.
# One of: filesystem | s3
STORAGE_BACKEND=filesystem

# Filesystem backend: path to the directory holding profiles.jsonl and passwords.jsonl.
# Required when STORAGE_BACKEND=filesystem.
CFP_PRIVATE_STORAGE_PATH=./private-storage

# S3 backend — only needed when STORAGE_BACKEND=s3.
# S3_ENDPOINT=https://s3.us-east-1.amazonaws.com
# S3_BUCKET=cfp-private-storage
# S3_REGION=us-east-1
# S3_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
# S3_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

# ---------------------------------------------------------------------------
# Auth
# ---------------------------------------------------------------------------

# GitHub OAuth app credentials. Create one at https://github.com/settings/developers.
# Callback URL for dev: http://localhost:3001/api/auth/github/callback
# GITHUB_OAUTH_CLIENT_ID=Iv1.a1b2c3d4e5f6g7h8
# GITHUB_OAUTH_CLIENT_SECRET=secret_abc123

# HS256 signing key for session JWTs. Generate a random string ≥ 32 chars.
# In production use a securely-generated secret; in dev any 32+ char string works.
CFP_JWT_SIGNING_KEY=change-me-to-a-random-string-at-least-32-chars

# ---------------------------------------------------------------------------
# SAML IdP (Slack integration) — only needed in production
# ---------------------------------------------------------------------------

# PEM-encoded private key for the SAML IdP certificate.
# SAML_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----

# PEM-encoded certificate matching SAML_PRIVATE_KEY.
# SAML_CERTIFICATE=-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----

# ---------------------------------------------------------------------------
# Static SPA serving (production only)
# ---------------------------------------------------------------------------

# Absolute path to the built apps/web/dist directory. When set, the API
# serves the SPA as a fallthrough for non-/api/* routes (single-image
# deploy per specs/architecture.md). Leave unset in dev — Vite owns 5173.
# CFP_WEB_DIST_PATH=/app/apps/web/dist