strata-books/.env.example at main · bitskc/strata-books · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Strata environment variables.
# Copy to `.env.local` for local development, or set these in your deploy
# platform (Vercel / Netlify / Cloudflare) project settings.

# ── Database (Supabase Postgres) ──────────────────────────────────────────────
# Pooled connection string used by the app at runtime.
DATABASE_URL=postgresql://postgres:password@host:5432/postgres
# Direct (non-pooled) connection — used by drizzle-kit for push/migrate.
# Optional; falls back to DATABASE_URL when unset.
DATABASE_DIRECT_URL=
# Optional pg pool size (default 5; lower to 2–3 on serverless).
DB_POOL_MAX=5

# ── Auth (custom JWT) ─────────────────────────────────────────────────────────
# REQUIRED. A long random secret used to sign session tokens. There is no
# fallback — with this unset, every request is treated as unauthenticated.
JWT_SECRET=

# ── Domain routing ────────────────────────────────────────────────────────────
# Your production root domain (e.g. strata.app). Enables the www → app.<domain>
# redirect and cross-subdomain session cookies. Leave empty for local/preview.
NEXT_PUBLIC_ROOT_DOMAIN=

# ── Audio object storage (durable + tier-checked) ─────────────────────────────
# Which storage driver serves episode audio:
#   local    (default) — dev only; proxies bytes from ./.storage (private).
#   supabase          — private Supabase Storage bucket + signed URLs.
#   r2                — Cloudflare R2 (S3-compatible, zero egress).
STORAGE_DRIVER=local
# Supabase Storage bucket name for audio (default "audio").
SUPABASE_AUDIO_BUCKET=audio

# Supabase project (also used for Postgres above if hosted there).
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
# Server-only service-role key — grants signed-URL / upload access to the
# private audio bucket. NEVER expose this to the client.
SUPABASE_SERVICE_ROLE_KEY=

# Cloudflare R2 (only if STORAGE_DRIVER=r2). See src/lib/storage/r2.ts.
# R2_ACCOUNT_ID=
# R2_ACCESS_KEY_ID=
# R2_SECRET_ACCESS_KEY=
# R2_BUCKET=

# ── LLM providers (pipeline + chat) ───────────────────────────────────────────
# At least one is required for the content pipeline / commentary chat.
ANTHROPIC_API_KEY=
GEMINI_API_KEY=
GROQ_API_KEY=
OPENROUTER_API_KEY=
# Providers allowed to generate flagship content (commentary/segmentation).
# Comma-separated. Defaults to "anthropic,gemini" — groq/openrouter default to
# free Llama models and are excluded unless you list them here.
PIPELINE_APPROVED_PROVIDERS=anthropic,gemini

# ── TTS provider (narration speech) ──────────────────────────────────────────
# "elevenlabs" (default, premium) or "edge" (free Microsoft neural voices;
# falls back to ElevenLabs on failure). SFX/atmosphere always uses ElevenLabs.
TTS_PROVIDER=elevenlabs

# ── Pipeline cost guard ──────────────────────────────────────────────────────
# Hard stop: the pipeline aborts a job when its estimated cost exceeds this
# many cents. 0 = no limit. Set via admin settings or here.
# PIPELINE_MAX_COST_CENTS=0

# ── Secret-at-rest encryption ─────────────────────────────────────────────────
# Encrypts secret app_settings (API keys) stored in the DB. Set a long random
# value in production; if unset, secrets are stored in plaintext (dev only).
SETTINGS_ENCRYPTION_KEY=

# ── Stripe (billing) ──────────────────────────────────────────────────────────
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_PRO_PRICE_ID=
# Optional fallback hosted checkout link (used when the Stripe API isn't
# configured).
STRIPE_CHECKOUT_URL=

# ── Inngest (pipeline orchestration) ──────────────────────────────────────────
INNGEST_SIGNING_KEY=

# ── Dev only ──────────────────────────────────────────────────────────────────
# Set to "1" to expose developer-only controls in the UI.
ENABLE_DEV_CONTROLS=