.env.example

# VDV463 Validator - Environment Configuration
# Copy this file to .env and fill in the values
# NEVER commit .env to version control!

# ============================================================================
# REQUIRED - Security Credentials
# ============================================================================

# JWT Secret Key - MUST be at least 32 characters, random and unique
# Generate with: openssl rand -hex 32
JWT_SECRET_KEY=

# Legacy Basic Auth (optional, for backward compatibility)
# Format: username:password
AUTH_SECRET=

# Disable authentication entirely (e.g. for trusted internal networks / air-gapped deployments)
# Set to true to bypass login - all API endpoints become publicly accessible.
# WARNING: Never use this on internet-facing deployments!
DISABLE_AUTH=false

# ============================================================================
# OPTIONAL - Google OAuth
# ============================================================================

# Google OAuth Client ID for Gmail login
# Get from: https://console.cloud.google.com/apis/credentials
GOOGLE_CLIENT_ID=

# ============================================================================
# OPTIONAL - Email Configuration (for verification/password reset)
# ============================================================================

# SMTP server settings (e.g., for Gmail: smtp.gmail.com)
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=

# Application URL (used in email links)
# MUST use https:// for production
APP_URL=https://localhost

# ============================================================================
# SECURITY - CORS and Origins
# ============================================================================

# Allowed CORS origins (comma-separated)
# For production, only list your actual domain(s)
ALLOWED_ORIGINS=https://localhost

# ============================================================================
# PORTS (optional, default values shown)
# ============================================================================

HTTPS_PORT=443
HTTP_PORT=80

# ============================================================================
# SECURITY CHECKLIST
# ============================================================================
# Before deploying to production:
# 
# [ ] Generate a strong, unique JWT_SECRET_KEY (32+ characters)
# [ ] Use real SSL certificates (Let's Encrypt or commercial CA)
# [ ] Set ALLOWED_ORIGINS to your actual domain only
# [ ] Configure SMTP for email verification
# [ ] Set APP_URL to your actual HTTPS domain
# [ ] Review and test rate limiting settings
# [ ] Enable firewall rules on your server
# [ ] Keep all dependencies updated
# [ ] Monitor logs for suspicious activity