# ==============================================================
# Environment Variables Template
# Copy this file to .env and fill in your values.
# All variables in src/env.js are listed here.
# ==============================================================


# ==============================================================
# App
# ==============================================================

# Application environment: dev | staging | prod
NEXT_PUBLIC_APP_ENV=dev

# Test account login shortcut is shown by default in all environments.
# Set to true to hide the "Login test account" button.
NEXT_PUBLIC_DISABLE_TEST_LOGIN=false

# Public URL of the app (payment callbacks, webhooks, referral links, etc.)
# Falls back to NEXTAUTH_URL if not set. Velobase Cloud auto-injects this.
APP_URL=http://localhost:3000

# Runtime services to start in standalone mode.
# Default is Web + Worker. Set SERVICE_MODE=all or SERVICE_MODE=api to enable the optional Hono API service.
# Options: web,worker | all | web | api | worker | web,api | web,api,worker
SERVICE_MODE=web,worker

# (Optional) Enable debug logs for specific modules, e.g. openai-agents:*
# DEBUG=


# ==============================================================
# Authentication (NextAuth v5)
# Generate a secret with: npx auth secret
# Docs: https://next-auth.js.org/configuration/options#secret
# ==============================================================

NEXTAUTH_SECRET=your-auth-secret-here
AUTH_URL=http://localhost:3000

# Google OAuth
# Create credentials at: https://console.cloud.google.com/apis/credentials
AUTH_GOOGLE_ID=
AUTH_GOOGLE_SECRET=

# GitHub OAuth
# Create an OAuth App at: https://github.com/settings/developers
# Callback URL: https://yourdomain.com/api/auth/callback/github
AUTH_GITHUB_ID=
AUTH_GITHUB_SECRET=

# Discord OAuth (optional)
AUTH_DISCORD_ID=
AUTH_DISCORD_SECRET=

# (Optional) Override the NextAuth base URL
# NEXTAUTH_URL=http://localhost:3000


# ==============================================================
# Database (PostgreSQL via Prisma)
#
# Option A - Docker (local dev):
#   docker compose up -d
#   DATABASE_URL=postgresql://velobase:velobase@localhost:5432/velobase
#
# Option B - Cloud:
#   Neon:     postgresql://user:pass@ep-xxx.neon.tech/neondb?sslmode=require
#   Supabase: postgresql://postgres.xxx:pass@pooler.supabase.com:6543/postgres
#   RDS:      postgresql://user:pass@your-instance.rds.amazonaws.com:5432/dbname
# ==============================================================

DATABASE_URL=postgresql://velobase:velobase@localhost:5432/velobase


# ==============================================================
# Redis (BullMQ job queues + rate limiting)
#
# Option A - Single URL (Velobase Cloud / managed Redis):
#   REDIS_URL=redis://:token@redis-host:6379
#
# Option B - Individual fields (local dev / self-hosted):
#   docker compose up -d
#
# When REDIS_URL is set, REDIS_HOST/PORT/PASSWORD are ignored.
# ==============================================================

# REDIS_URL=
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_USER=
REDIS_PASSWORD=
REDIS_DB=0

# Worker HTTP port (health check + Bull Board UI at /_worker/queues)
# Start worker with: pnpm worker:dev (dev) | pnpm worker:prod (prod)
WORKER_PORT=3001


# ==============================================================
# Object Storage (S3-compatible)
# STORAGE_PROVIDER options: aws | aliyun | gcs | minio | r2
# ==============================================================

STORAGE_PROVIDER=r2

# Cloudflare R2 example:
STORAGE_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
STORAGE_BUCKET=your-bucket-name
STORAGE_ACCESS_KEY_ID=your-access-key-id
STORAGE_SECRET_ACCESS_KEY=your-secret-access-key

# AWS S3 / Aliyun OSS / GCS also require:
# STORAGE_REGION=us-east-1

# (Optional) Path prefix for multi-tenant shared bucket (Velobase Cloud sets this automatically)
# STORAGE_PATH_PREFIX=

# CDN base URL for serving stored files
CDN_BASE_URL=https://cdn.example.com


# ==============================================================
# AI Providers
# At least one LLM key is required for chat/generation features.
# ==============================================================

# Anthropic Claude
# https://console.anthropic.com/
ANTHROPIC_API_KEY=

# OpenAI
# https://platform.openai.com/api-keys
OPENAI_API_KEY=
# Optional: custom base URL for OpenAI-compatible proxies
# OPENAI_BASE_URL=

# OpenRouter (routes to multiple LLM providers)
# https://openrouter.ai/keys
OPENROUTER_API_KEY=

# xAI (Grok)
# https://console.x.ai/
XAI_API_KEY=

# Google Gemini
# https://aistudio.google.com/app/apikey
GEMINI_API_KEY=

# Volcengine Ark (ByteDance, for image/video generation)
# https://console.volcengine.com/ark
VOLCENGINE_API_KEY=
VOLCENGINE_ARK_ENDPOINT=https://ark.cn-beijing.volces.com/api/v3

# Datalab (document parsing / OCR)
# https://www.datalab.to/
DATALAB_API_KEY=
# DATALAB_BASE_URL=https://api.datalab.to

# Wavespeed (video generation)
WAVESPEED_API_KEY=


# ==============================================================
# Payments
# ==============================================================

# ---------- Stripe (primary) ----------
# https://dashboard.stripe.com/apikeys
STRIPE_SECRET_KEY=sk_test_...
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
# Webhook secret:
#   Production: from https://dashboard.stripe.com/webhooks
#   Local quick checkout tests: any non-empty placeholder is enough for provider registration
#   Local webhook testing: run `make stripe` and copy the whsec_xxx from the output
STRIPE_WEBHOOK_SECRET=whsec_...

# ---------- NowPayments (crypto, optional) ----------
# https://nowpayments.io/
NOWPAYMENTS_API_KEY=
NOWPAYMENTS_IPN_SECRET=
# Default crypto currency for payments (default: usdttrc20)
# NOWPAYMENTS_PAY_CURRENCY=usdttrc20

# ---------- Force payment gateway (testing only) ----------
# Override default gateway routing. Options: STRIPE | NOWPAYMENTS
# FORCE_PAYMENT_GATEWAY=


# ==============================================================
# Telegram Bot (Telegram Stars payment + notifications)
# Create a bot via: https://t.me/BotFather
# ==============================================================

TELEGRAM_BOT_TOKEN=
TELEGRAM_WEBHOOK_SECRET=your-custom-webhook-secret
NEXT_PUBLIC_TELEGRAM_BOT_USERNAME=your_bot_username


# ==============================================================
# Email Services
# EMAIL_PROVIDER: comma-separated provider chain (order = priority)
#   "resend"              → Resend only
#   "sendgrid"            → SendGrid only
#   "resend,sendgrid"     → Resend first, SendGrid fallback (default)
#   "sendgrid,resend"     → SendGrid first, Resend fallback
# ==============================================================

EMAIL_PROVIDER=resend,sendgrid

# Resend: https://resend.com/api-keys
RESEND_API_KEY=
RESEND_WEBHOOK_SECRET=whsec_...

# SendGrid: https://app.sendgrid.com/settings/api_keys
SENDGRID_API_KEY=


# ==============================================================
# Lark / Feishu Bot (internal notifications)
# Lark: https://open.larksuite.com/
# Feishu (China): https://open.feishu.cn/
# Set LARK_USE_FEISHU=true to use Feishu endpoints instead of Lark.
# ==============================================================

LARK_APP_ID=
LARK_APP_SECRET=
LARK_USE_FEISHU=false
# Optional: default chat/group ID for notifications
# LARK_DEFAULT_CHAT_ID=

# Required if you configure Lark event subscriptions with encryption
LARK_ENCRYPT_KEY=
LARK_VERIFICATION_TOKEN=

# Feishu (domestic China version, independent app credentials)
FEISHU_APP_ID=
FEISHU_APP_SECRET=


# ==============================================================
# Analytics & Marketing
# ==============================================================

# PostHog (product analytics)
# https://posthog.com/
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
# Server-side PostHog API key (for backend event ingestion)
POSTHOG_API_KEY=

# ==============================================================
# Ads — Frontend conversion tracking (all optional, disabled when empty)
# ==============================================================
# Google Ads: Get from Google Ads → Tools → Conversions → Tag setup
NEXT_PUBLIC_GOOGLE_ADS_MEASUREMENT_ID=
NEXT_PUBLIC_GOOGLE_ADS_CONVERSION_LABEL=
# Twitter/X Ads: Get from Twitter Ads → Events Manager
NEXT_PUBLIC_TWITTER_PIXEL_ID=
NEXT_PUBLIC_TWITTER_PURCHASE_EVENT_ID=
# PropellerAds: Get from PropellerAds dashboard
NEXT_PUBLIC_PROPELLER_AID=
NEXT_PUBLIC_PROPELLER_TID=
# TrafficJunky: Get from TrafficJunky dashboard
NEXT_PUBLIC_TJ_ACCOUNT_ID=
NEXT_PUBLIC_TJ_MEMBER_ID=

# ==============================================================
# Ads — Google Ads Server API (offline conversion upload, all optional)
# Docs: https://developers.google.com/google-ads/api/docs/get-started/introduction
# ==============================================================
GOOGLE_ADS_DEVELOPER_TOKEN=
GOOGLE_ADS_CLIENT_ID=
GOOGLE_ADS_CLIENT_SECRET=
GOOGLE_ADS_REFRESH_TOKEN=
GOOGLE_ADS_CUSTOMER_ID=
# Optional: MCC (manager account) ID
# GOOGLE_ADS_MCC_ID=
# Conversion action IDs from your Google Ads account
GOOGLE_ADS_CONVERSION_ACTION_ID=
GOOGLE_ADS_WEB_CONVERSION_ACTION_ID=


# ==============================================================
# Security & Anti-abuse
# ==============================================================

# Cloudflare Turnstile (CAPTCHA)
# https://developers.cloudflare.com/turnstile/
NEXT_PUBLIC_TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=

# Cookie secure flag override
# - "true"  → cookies use Secure attribute (standard HTTPS)
# - "false" → disable Secure (required for Cloudflare Flexible SSL)
# - (empty) → auto: secure in production, insecure in development
COOKIE_SECURE=

# Velobase Billing (credits management)
# https://velobase.io
VELOBASE_API_KEY=

# IPQS (IP Quality Score - fraud/bot detection)
# https://www.ipqualityscore.com/
IPQS_API_KEY=


# ==============================================================
# MCP Server (optional, for local development tooling)
# ==============================================================

# MCP_SERVER_URL=http://localhost:3100


# ==============================================================
# Proxy (optional, for accessing Google APIs from regions with restrictions)
# ==============================================================

# HTTPS_PROXY=http://127.0.0.1:7897
# HTTP_PROXY=http://127.0.0.1:7897
