.env.example

# kurrentschrift environment variables
# Copy to .env and fill in your values. Never commit .env.

# ============================================================================
# Database
# ============================================================================

# Any empty PostgreSQL database works: `uv run alembic upgrade head` creates
# the schema and seeds the base styles.

# Local dev — Cloud SQL public IP of the anyplot instance, kurrentschrift DB:
# DATABASE_URL=postgresql+asyncpg://kurrentschrift:PASSWORD@<ANYPLOT_PUBLIC_IP>:5432/kurrentschrift

# Cloud Run — Unix socket via Cloud SQL connector:
# DATABASE_URL=postgresql+asyncpg://kurrentschrift:PASSWORD@/kurrentschrift?host=/cloudsql/anyplot:europe-west4:anyplot-db

DATABASE_URL=

# ============================================================================
# App
# ============================================================================

ENVIRONMENT=development
PORT=8000

# ============================================================================
# Admin auth (write endpoints in api/routers/bboxes.py + templates.py)
# ============================================================================

# Cloudflare Access (Zero Trust). Filled in once the Self-hosted Application
# is created in the CF Zero Trust dashboard. Leave unset locally — without
# Cloudflare Access, require_admin falls back to ADMIN_TOKEN.
# CF_ACCESS_TEAM_DOMAIN=kurrentschrift.cloudflareaccess.com
# CF_ACCESS_AUD=

# Shared secret for break-glass / CI / local dev access. Generate with:
#   openssl rand -hex 32
# Sent as the X-Admin-Token header.
# ADMIN_TOKEN=

# Comma-separated list of Google emails allowed via the Cloudflare Access JWT
# path. Required for the JWT path to authorize anyone — valid JWTs with an
# email not on this list get 403.
# ADMIN_ALLOWED_EMAILS_RAW=me@example.com

# ============================================================================
# Origin gate (production only)
# ============================================================================

# Shared secret between the Cloudflare edge and the API: a Transform Rule
# stamps `X-Origin-Secret` onto every request it proxies for
# api.kurrentschrift.ink, and api/origin_gate.py refuses anything else with
# 403 — which is what closes the direct *.run.app door past the rate limit and
# the WAF. LEAVE UNSET LOCALLY: unset means the check is off, which is also the
# production rollback (remove the variable from the Cloud Run service).
# Generate with: openssl rand -hex 32   — never with `echo`, which appends a
# newline a header cannot carry (the ADMIN_TOKEN outage of 2026-08).
# ORIGIN_SECRET=