.env.example

# ── Database ──────────────────────────────────────────────────────────
# Option A: Internal Postgres (docker compose --profile internal-db up)
DB_NAME=studyhabit
DB_USER=studyhabit
DB_PASSWORD=changeme_strong_password_here

# Option B: External database (Supabase, Railway, Neon, etc.)
#   Comment out DB_* above and set DATABASE_URL directly.
#   When using an external DB, omit --profile internal-db.
# DATABASE_URL=postgresql://user:pass@db.host:5432/studyhabit

# When using the internal DB, this is auto-constructed in docker-compose.
# Override ONLY if you need to point to an external database.
DATABASE_URL=postgresql://${DB_USER}:${DB_PASSWORD}@db:5432/${DB_NAME}

# ── Auth ──────────────────────────────────────────────────────────────
# Generate: openssl rand -hex 32
JWT_SECRET=changeme_min64chars_random_hex_string
JWT_REFRESH_SECRET=changeme_different_min64chars_random_hex
JWT_ACCESS_EXPIRY=15m
JWT_REFRESH_EXPIRY=7d
MAX_DEVICES_PER_USER=5

# ── Networking ────────────────────────────────────────────────────────
# Public URL where the API will be reachable (used by web frontend build)
API_URL=http://localhost:3001
API_PORT=3001
WEB_PORT=3000

# Comma-separated origins allowed for CORS.
# For production, set this to your exact web origin(s), e.g. https://studyhabit.schuelken.uk
# Use "*" ONLY for local development — with "*" the API disables credentials.
CORS_ORIGIN=https://studyhabit.schuelken.uk

# ── Rate Limiting ─────────────────────────────────────────────────────
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=100