.example.env

# ============================================================================
# GhostClass Environment Variables
# ============================================================================
# Copy this file to `.env` and fill in your actual values.
# NEVER commit the `.env` file to version control!
#
# Required variables are marked with ⚠️
# Optional variables are marked with ℹ️
#
# HOW CONFIGURATION WORKS (Infisical Centralization)
# ─────────────────────────────────────────────────────────────────────────────
#
#  🔐 Infisical Dashboard acts as the Single Source of Truth, organized into 3 folders:
#
#  📁 /build-time  →  Fetched dynamically at build time by GitHub Actions workflows
#     Using the `infisical/secrets-action` step to inject values directly into memory runner steps
#     (with graceful fallback to native GitHub Variables/Secrets if Infisical isn't configured).
#     Note: Some derived values (e.g. NEXT_PUBLIC_APP_URL=https://${NEXT_PUBLIC_APP_DOMAIN})
#     are dynamically constructed by the pipeline logic at build time.
#
#  📁 /runtime     →  Server Env Var
#     Injected dynamically into memory at container boot time for Coolify / Server environments.
#     Since native integration is unsupported, the container boot command wraps the Infisical CLI
#     (`infisical run -- node server.js`), fetching runtime secrets directly into the Node.js process
#     using the provided INFISICAL_TOKEN and INFISICAL_PROJECT_ID environment variables without storing plaintext secrets on disk.
#
#  📁 /ci          →  GitHub CI/CD
#     Workflow runner automation credentials (signing keys, deployment triggers).
#     Never injected into the web application container.
#
# ─────────────────────────────────────────────────────────────────────────────

# ============================================================================
# 🔨 BUILD-TIME  (Infisical `/build-time` folder → fetched dynamically in workflows)
# ============================================================================

# ----------------------------------------------------------------------------
# App identity
# ----------------------------------------------------------------------------

# ⚠️ Application name displayed in UI and emails
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_APP_NAME=GhostClass

# ⚠️ App version displayed in footer and health checks
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_APP_VERSION=4.4.9

# ⚠️ Your production domain WITHOUT https://
# All URL-based variables are derived from this.
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_APP_DOMAIN=ghostclass.devakesu.com

# ℹ️ Fallback domain (optional, for multi-environment deployments)
# Only needed when deploying to multiple environments without per-env config.
# Falls back to this when NEXT_PUBLIC_APP_DOMAIN is not set.
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_DEFAULT_DOMAIN=

# ℹ️ Author / maintainer information
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_AUTHOR_NAME=@deva.kesu
NEXT_PUBLIC_AUTHOR_URL=https://devakesu.com

# ℹ️ GitHub repository URL
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_GITHUB_URL=https://github.com/devakesu/GhostClass

# ℹ️ Donation / sponsor link shown in footer (optional)
# Examples: https://github.com/sponsors/username  |  https://ko-fi.com/username
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_DONATE_URL=

# ----------------------------------------------------------------------------
# Derived URL variables (auto-generated from NEXT_PUBLIC_APP_DOMAIN)
# Do NOT set these manually — the pipeline constructs them automatically.
# 🔨 Build-time (auto-constructed by release pipeline)
# ----------------------------------------------------------------------------
NEXT_PUBLIC_APP_URL=https://${NEXT_PUBLIC_APP_DOMAIN}
NEXT_PUBLIC_SITEMAP_URL=https://${NEXT_PUBLIC_APP_DOMAIN}/sitemap.xml
NEXT_PUBLIC_APP_EMAIL=@${NEXT_PUBLIC_APP_DOMAIN}
NEXT_PUBLIC_LEGAL_EMAIL=legal@${NEXT_PUBLIC_APP_DOMAIN}


# ----------------------------------------------------------------------------
# EzyGo integration
# ----------------------------------------------------------------------------

# ⚠️ EzyGo API base URL
# Set to the Cloudflare egress Worker URL in production (recommended) to route
# traffic through Cloudflare's edge IPs and avoid per-IP rate-limit blocks.
# Example (CF Worker):  https://ezygo-proxy.<your-cf-username>.workers.dev/api/v1/Xcr45_salt
# Example (direct):     https://production.api.ezygo.app/api/v1/Xcr45_salt
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_BACKEND_URL=https://production.api.ezygo.app/api/v1/Xcr45_salt

# ----------------------------------------------------------------------------
# Supabase (public / client-side keys)
# Get credentials at: https://supabase.com → Project Settings → API
# ----------------------------------------------------------------------------

# ⚠️ Supabase project URL (Production)
# Always set this to the REAL supabase.co URL — used by the Next.js server,
# image optimisation, and CSP. Never change this to the proxy URL.
# Example: https://abcdefghijklmnop.supabase.co
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_SUPABASE_URL=

# ℹ️ Supabase project URL (Development override)
# If set, this URL will be used instead of the production one when NODE_ENV=development.
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_SUPABASE_DEV_URL=

# ℹ️ Supabase browser proxy — Development override (optional)
# Used by the browser client and CSP checks in local development when you want
# to point the app at a different proxy target than production.
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_SUPABASE_DEV_PROXY_URL=

# ℹ️ Supabase browser proxy — Tier 1: Cloudflare Worker (ISP bypass, optional)
# Deploy workers/supabase-proxy/index.js as a CF Worker, then set this to the
# worker URL. The browser client tries CF first, falls back to AWS (Tier 2),
# then falls back to direct supabase.co. Leave blank for direct connections.
# Example: https://ghostclass-supabase-proxy.<your-cf-username>.workers.dev
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_SUPABASE_CF_PROXY_URL=

# ℹ️ Supabase browser proxy — Tier 2: AWS Lambda (ISP bypass fallback, optional)
# Deploy workers/supabase-proxy-aws/index.mjs as a Lambda + HTTP API Gateway,
# then set this to the API Gateway invoke URL. Used when the CF Worker fails or
# quota is exceeded. Leave blank to skip this tier.
# Example: https://<api-gw-id>.execute-api.ap-south-1.amazonaws.com
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_SUPABASE_AWS_PROXY_URL=

# ⚠️ Supabase Publishable (public) key — safe to expose to the browser
# Starts with: sb_publishable_... (previously anon key)
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=

# ℹ️ Supabase publishable key (Development override)
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_SUPABASE_DEV_PUBLISHABLE_KEY=

# ----------------------------------------------------------------------------
# Cloudflare Turnstile (public site key)
# Get keys at: https://dash.cloudflare.com/ → Turnstile
# ----------------------------------------------------------------------------

# ⚠️ Turnstile Site Key — visible in browser, used on login/contact forms
# Testing key (always passes, dev only): 1x00000000000000000000AA
# 🚨 Replace with a real production key before deploying!
# 🔨 Build-time (Infisical `/build-time` folder)
NEXT_PUBLIC_TURNSTILE_SITE_KEY=1x00000000000000000000AA

# ----------------------------------------------------------------------------
# Sentry — build-time portion (source map upload during docker build)
# Get credentials at: https://sentry.io/settings/
# ----------------------------------------------------------------------------

# ⚠️ Sentry organisation slug (e.g. "devakesu" from sentry.io/organizations/devakesu/)
# 🔨 Build-time (Infisical `/build-time` folder — used by `next build` to upload source maps)
SENTRY_ORG=devakesu

# ⚠️ Sentry project slug (e.g. "ghostclass")
# 🔨 Build-time (Infisical `/build-time` folder — used by `next build` to upload source maps)
SENTRY_PROJECT=ghostclass

# ⚠️ Sentry Auth Token — uploaded via BuildKit secret mount, never baked into image layers
# Create at: https://sentry.io/settings/account/api/auth-tokens/
# Required scopes: project:read, project:releases, org:read  |  Starts with: sntrys_...
# 🔨 Build-time (Infisical `/build-time` folder — secret mount during `docker build`)
SENTRY_AUTH_TOKEN=

# ℹ️ Sentry Auth Token for Mobile App (Flutter) — uploaded for debug symbols during APK build
# If unset, falls back to SENTRY_AUTH_TOKEN.
# 🔨 Build-time (Infisical `/build-time` folder — consumed by sentry_dart_plugin)
MOBILE_SENTRY_AUTH_TOKEN=

# ⚠️ Sentry DSN (Data Source Name) — public key for browser error reporting
# Found at: Sentry → Project Settings → Client Keys (DSN)
# Example: https://abc123@o123456.ingest.sentry.io/7654321
# 🔨 Build-time (Infisical `/build-time` folder — compiled into JS bundle)
NEXT_PUBLIC_SENTRY_DSN=

# ℹ️ Sentry DSN for Mobile App (Flutter) — public key for mobile error reporting
# If unset, falls back to NEXT_PUBLIC_SENTRY_DSN.
# Found at: Sentry → Mobile Project Settings → Client Keys (DSN)
# 🔨 Build-time (Infisical `/build-time` folder — compiled into Flutter APK)
NEXT_PUBLIC_MOBILE_SENTRY_DSN=

# ℹ️ Sentry Session Replay sample rate (0.0–1.0, default: 0 = disabled)
# Example: 0.1 = 10% of sessions. Warning: increases bandwidth and Sentry quota.
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_SENTRY_REPLAY_RATE=0

# ----------------------------------------------------------------------------
# Google Analytics (Measurement ID — public)
# Get from: https://analytics.google.com/
# ----------------------------------------------------------------------------

# ℹ️ GA4 Measurement ID (optional)
# Format: G-XXXXXXXXXX  |  Get from: GA4 Admin → Data Streams → Measurement ID
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_GA_ID=

# ----------------------------------------------------------------------------
# User settings defaults
# ----------------------------------------------------------------------------

# ℹ️ Minimum attendance target percentage users can set (default: 75, range: 1–100)
# Adjust to match your institution's minimum attendance requirement.
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_ATTENDANCE_TARGET_MIN=75

# ----------------------------------------------------------------------------
# CSP / build flags
# ----------------------------------------------------------------------------

# ℹ️ Force production-like CSP in development — client-side flag (optional)
# Valid: "true", "1", "yes". See FORCE_STRICT_CSP in the Runtime section for
# the server-side counterpart (kept separate so the runtime flag can be toggled
# without a rebuild).
# ⚠️ 'unsafe-eval' is still present in dev even with this set; Next.js HMR
#    requires it. Use `npm run build && npm start` to test a fully strict CSP.
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_FORCE_STRICT_CSP=

# ℹ️ Enable Service Worker in development mode (optional)
# Valid: "true", "false" (default: false). Useful for testing PWA features locally.
# 🔨 Build-time (Infisical `/build-time` folder — optional)
NEXT_PUBLIC_ENABLE_SW_IN_DEV=false

# ----------------------------------------------------------------------------
# Mobile App Metadata (Build-time)
# ----------------------------------------------------------------------------

# ℹ️ Android Package Name (e.g., com.ghostclass.app)
# 🔨 Build-time (Infisical `/build-time` folder )
NEXT_PUBLIC_ANDROID_PACKAGE_NAME=com.devakesu.apps.ghostclass

# ⚠️ Base64-encoded google-services.json file for Firebase / Google Services Plugin
# Required for building the release APK. Encode using: base64 -w 0 -i google-services.json
# 🔨 Build-time (Infisical `/build-time` folder)
GOOGLE_SERVICES_JSON_BASE64=

# 🔑 Dynamic Firebase Client API Keys (Overrides for firebase_options.dart)
# FIREBASE_API_KEY_ANDROID is automatically derived from google-services.json during CI releases.
# Populating these variables overrides the auto-derived values.
# 🔨 Build-time (Infisical `/build-time` folder)
FIREBASE_API_KEY_ANDROID=
FIREBASE_API_KEY_IOS=

# ----------------------------------------------------------------------------
# Development / Local Sync Utilities
# ----------------------------------------------------------------------------

# ℹ️ Set to "true" to enable HTTPS in local development (dev:https script)
HTTPS=

# ℹ️ Set to "true" when running Vitest tests
VITEST=

# ℹ️ Fallback client IP for development/testing (optional)
# Used to bypass local network IP detection when testing rate limits or geo-features.
# Example: 203.0.113.45
TEST_CLIENT_IP=

# ----------------------------------------------------------------------------
# Build reproducibility (auto-set by pipeline — do not change manually)
# ----------------------------------------------------------------------------

# ⚠️ Unix timestamp pinning the build output for reproducible Docker images
# Auto-derived at build time from the git commit timestamp (git log -1 --format=%ct).
# Same commit tag → same epoch → same image digest. NOT a GitHub Variable or Secret.
# The value below is a local-dev fallback only; the pipeline never reads it.
# 🔨 Build-time (auto-derived from git commit by release pipeline)
SOURCE_DATE_EPOCH=1767225600

# Auto-populated by GitHub Actions
# 🔨 Build-time (auto-generated by pipeline)
APP_COMMIT_SHA=<auto-generated-by-github-actions>
NEXT_PUBLIC_GIT_COMMIT_SHA=<auto-generated-by-github-actions>
#   Full commit SHA for footer display; auto-populated from git rev-parse HEAD.
#   APP_COMMIT_SHA is used for the provenance API endpoint.
#   NEXT_PUBLIC_GIT_COMMIT_SHA is exposed to the browser for footer display.
BUILD_TIMESTAMP=<auto-set-by-pipeline>
#   ISO 8601 timestamp of the Docker build; exposed by /api/provenance endpoint.
AUDIT_STATUS=<auto-set-by-pipeline>
#   Result of `npm audit` during build (e.g. "PASSED" or "FAILED-HIGH").
SIGNATURE_STATUS=<auto-set-by-pipeline>
#   Docker image signing state (e.g. "SLSA_PROVENANCE_GENERATED", "UNSIGNED").
IMAGE_DIGEST=<auto-set-by-pipeline>
#   sha256 digest of the published Docker image; exposed by /api/provenance.


# ============================================================================
# 🚀 RUNTIME  (Infisical `/runtime` folder → Server Env Var)
# ============================================================================

# Egress proxy chain — 3-tier failover for EzyGo API requests
# NEXT_PUBLIC_BACKEND_URL (above) is always the direct EzyGo URL.
# The tiers below are server-side only; configure in your server env at runtime.
#
# Tier 1: Cloudflare Worker (CF_PROXY_URL + CF_PROXY_SECRET)
#   CF_PROXY_URL: Your deployed CF Worker URL including the path prefix.
#     Example: https://ezygo-proxy.<username>.workers.dev/api/v1/Xcr45_salt
#     Leave empty to skip this tier (traffic goes directly to tier 2 or EzyGo).
#   CF_PROXY_SECRET: Shared secret the Worker validates (x-proxy-secret header).
#     Must match PROXY_SECRET in the CF Worker's encrypted settings.
#     Generate with: openssl rand -hex 32
#     UNIFIED NAMING: same variable in server env (runtime) AND upstream CI folder.
#     Infisical centralizes both automatically.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var) + 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
CF_PROXY_URL=
CF_PROXY_SECRET=

# Tier 2: AWS Lambda + API Gateway (AWS_SECONDARY_URL + AWS_SECONDARY_SECRET)
#   AWS_SECONDARY_URL: API Gateway invoke URL for the Lambda proxy.
#     Get from: AWS API Gateway → your API → Invoke URL
#     Example: https://abc123.execute-api.ap-south-1.amazonaws.com
#     Leave empty to skip this tier.
#   AWS_SECONDARY_SECRET: DIFFERENT value from CF_PROXY_SECRET (key separation).
#     Must match PROXY_SECRET in the Lambda's environment variables.
#     Generate with: openssl rand -hex 32
#     UNIFIED NAMING: same variable in server env (runtime) AND upstream CI folder.
#     Infisical centralizes both automatically.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var) + 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
AWS_SECONDARY_URL=
AWS_SECONDARY_SECRET=

# ----------------------------------------------------------------------------
# Encryption & signing secrets
# ----------------------------------------------------------------------------

# ⚠️ AES-256-GCM encryption key for tokens and auth credentials
# Must be exactly 64 hexadecimal characters (32 bytes).
# Generate: openssl rand -hex 32
# ⚠️ NEVER share — changing it invalidates all encrypted data.
# Used for: EzyGo token encryption, canonical password storage
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
ENCRYPTION_KEY=

# ⚠️ Authorisation token for automated sync cron jobs
# Generate: openssl rand -base64 32  |  Used in: /api/cron/sync
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
# 💡 Coolify Scheduled Task Syntax (Memory-injected secrets):
# infisical run --path /runtime --env production -- sh -c 'curl -sS -H "Authorization: Bearer $CRON_SECRET" "http://localhost:3000/api/cron/sync"'
CRON_SECRET=

# ℹ️ Maximum age for signed requests in seconds (default: 600 = 10 min)
# Prevents replay attacks. Valid range: 60–3600 seconds.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
REQUEST_SIGNATURE_MAX_AGE=600

# ⚠️ RSA Private Key for JWE bi-directional encryption/decryption
# Generate: node scripts/generate-jwe-keys.js
# Paste the PEM content (replace newlines with \n for .env)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
JWE_PRIVATE_KEY=

# ----------------------------------------------------------------------------
# Mobile Security & Attestation (Zero-Trust)
# ----------------------------------------------------------------------------

# ⚠️ Minimum supported app version required to bypass forced update
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
MIN_APP_VERSION=4.4.9

# ℹ️ Enforce Firebase App Check for all mobile clients in production
# Valid: "true", "false" (default: false in dev, true recommended in prod)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
ENFORCE_APP_CHECK=false

# ℹ️ Firebase App ID (Android)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
FIREBASE_APP_ID_ANDROID=

# ℹ️ Firebase App ID (iOS)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
FIREBASE_APP_ID_IOS=

# ℹ️ Firebase Admin Service Account (JSON string or Base64)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
# Required when ENFORCE_APP_CHECK=true for server-side token verification.
GOOGLE_SERVICE_ACCOUNT_JSON=

# ----------------------------------------------------------------------------
# CSP server-side flag
# ----------------------------------------------------------------------------

# ℹ️ Force production-like CSP in development — server-side flag (optional)
# Valid: "true", "1", "yes". See NEXT_PUBLIC_FORCE_STRICT_CSP for the
# client-side twin. Useful for staging environments without a rebuild.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
FORCE_STRICT_CSP=

# ----------------------------------------------------------------------------
# Upstash Redis (rate limiting)
# Get credentials at: https://upstash.com  |  Free tier: 10,000 commands/day
# ----------------------------------------------------------------------------

# ⚠️ Upstash Redis REST API URL
# Example: https://your-redis-instance.upstash.io
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
UPSTASH_REDIS_REST_URL=

# ⚠️ Upstash Redis REST API Token (starts with "A...")
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
UPSTASH_REDIS_REST_TOKEN=

# ----------------------------------------------------------------------------
# Rate limiting (sliding window algorithm)
# Adjust based on server capacity and expected traffic.
# ----------------------------------------------------------------------------

# General endpoints (sync, contact, etc.) — recommended: 30 req / 10 s
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
RATE_LIMIT_REQUESTS=30
RATE_LIMIT_WINDOW=10

# Cron sync endpoint override (falls back to RATE_LIMIT_* when unset)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
SYNC_RATE_LIMIT_REQUESTS=10
SYNC_RATE_LIMIT_WINDOW=10

# Contact endpoint override (falls back to RATE_LIMIT_* when unset)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
CONTACT_RATE_LIMIT_REQUESTS=10
CONTACT_RATE_LIMIT_WINDOW=10

# Profile endpoint override (falls back to auth defaults when unset)
# ⚠️ This limiter is independent from AUTH_RATE_LIMIT_*. Increase this if
# /api/profile hits 429s during startup sync bursts.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
PROFILE_RATE_LIMIT_REQUESTS=15
PROFILE_RATE_LIMIT_WINDOW=60

# Backend proxy endpoint override (EzyGo traffic)
# ⚠️ This limiter is independent from RATE_LIMIT_*.
# If you are seeing 429s on /api/backend/*, tune these values.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
PROXY_RATE_LIMIT_REQUESTS=120
PROXY_RATE_LIMIT_WINDOW=60

# Auth endpoints — keep low to prevent brute-force attacks
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
AUTH_RATE_LIMIT_REQUESTS=5
AUTH_RATE_LIMIT_WINDOW=60

# ℹ️ Auth lock TTL in seconds during the save-token process (default: 20)
# Prevents race conditions when multiple login requests arrive simultaneously.
# Range: 15–60 seconds.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
AUTH_LOCK_TTL=20

# ----------------------------------------------------------------------------
# Supabase — service role (admin key, server-side only)
# ----------------------------------------------------------------------------

# ⚠️ Supabase Secret key — ADMIN ACCESS, NEVER expose to the browser!
# Used for server-side operations that bypass Row Level Security (RLS).
# Replaces the legacy service_role key. Starts with: sb_secret_...
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
SUPABASE_SECRET_KEY=

# ℹ️ Supabase secret key (Development override)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional)
SUPABASE_DEV_SECRET_KEY=

# ----------------------------------------------------------------------------
# Cloudflare Turnstile — secret key (server-side)
# ----------------------------------------------------------------------------

# ⚠️ Turnstile Secret Key — server-side only, NEVER expose to the browser!
# Testing key (always passes, dev only): 1x0000000000000000000000000000000AA
# 🚨 Replace with a real production key before deploying!
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
TURNSTILE_SECRET_KEY=1x0000000000000000000000000000000AA

# ----------------------------------------------------------------------------
# Email services (dual-provider failover)
# At least ONE provider must be configured for contact forms and notifications.
# ----------------------------------------------------------------------------

# ℹ️ SendPulse — Primary email provider
# Get credentials at: https://sendpulse.com/integrations/api
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional if Brevo is configured)
SENDPULSE_CLIENT_ID=
SENDPULSE_CLIENT_SECRET=

# ℹ️ Brevo (formerly Sendinblue) — Fallback email provider
# Get API key at: https://app.brevo.com/settings/keys/api  |  Free: 300 emails/day
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — optional if SendPulse is configured)
BREVO_API_KEY=

# ----------------------------------------------------------------------------
# Sentry — runtime portion (data redaction salt)
# ----------------------------------------------------------------------------

# ⚠️ Hash salt for redacting sensitive data (emails, IDs) in Sentry error reports
# Lazy-loaded at first use — NOT required at build time, only at runtime.
# Generate: openssl rand -base64 32  |  Treat like a database credential.
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var)
SENTRY_HASH_SALT=

# ----------------------------------------------------------------------------
# Google Analytics — API secret (server-side)
# ----------------------------------------------------------------------------

# ⚠️ GA4 API Secret — server-side only, NEVER expose to the browser
# Used for server-side event tracking via GA4 Measurement Protocol.
# Get from: GA4 Admin → Data Streams → Measurement Protocol API secrets
# Format: random alphanumeric string (e.g. abc123DEF456ghi789JKL)
# 🚀 Runtime (Infisical `/runtime` folder → Server Env Var — required if NEXT_PUBLIC_GA_ID is set)
GA_API_SECRET=


# ============================================================================
# 🚀 COOLIFY / RUNTIME BOOTSTRAP SECRETS (Infisical CLI Wrapper)
# Configure these directly inside your Coolify Environment Variables dashboard.
# They are consumed dynamically at boot time to inject `/runtime` secrets into memory.
# ============================================================================

# Target Project ID containing your centralized configuration secrets
# Locate at: Infisical Dashboard → Project Settings → General → Project ID
INFISICAL_PROJECT_ID=

# Scoped Machine Identity token granting read access to the `/runtime` folder
# Generate at: Infisical Dashboard → Access Control → Machine Identities
INFISICAL_TOKEN=


# ============================================================================
# 🔑 CI/CD-ONLY  (Infisical `/ci` folder → GitHub CI/CD)
# These are NOT server/Docker runtime env vars — never inject them into the container.
# Set upstream values directly in the Infisical Dashboard `/ci` environment folder.
# ============================================================================
#
# NOTE ON PROXY CONFIG: CF_PROXY_URL, CF_PROXY_SECRET, AWS_SECONDARY_URL,
# and AWS_SECONDARY_SECRET serve double duty for server runtime AND GitHub CI/CD automation.
# Therefore, in your Infisical dashboard, they must be populated in both `/runtime` and `/ci` folders.
#
# NOTE ON EZYGO API URL: CF Worker and AWS Lambda both use NEXT_PUBLIC_BACKEND_URL
# (already a GitHub Actions Variable) as their upstream EZYGO_API_URL target.
# No separate CF_EZYGO_API_URL or AWS_EZYGO_API_URL variables are needed.
# ── Infisical Live Fetch Automation ──────────────────────────────────────────
# Machine Identity credentials used by release.yml to dynamically fetch
# variables from the Infisical Dashboard `/build-time` folder during compilation.
# Generate at: Infisical Dashboard → Project Settings → Machine Identities
# Assign scope: read-only access to `/build-time` in the target environment.
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
INFISICAL_CLIENT_ID=
INFISICAL_CLIENT_SECRET=

# ⚠️ Infisical Project Slug (String identifier, e.g. "ghostclass-abcd")
# Find at: Infisical Dashboard → Project Settings → General → Project Slug
# Required by the infisical/secrets-action to target the correct repository.
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
INFISICAL_PROJECT_SLUG=

# ── Server deployment trigger ────────────────────────────────────────────────
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
COOLIFY_BASE_URL=
COOLIFY_APP_ID=
COOLIFY_API_TOKEN=

# Optional workflow variable:
# Allow release.yml to fall back to localhost when NEXT_PUBLIC_APP_DOMAIN is unset
# on non-tag/manual dispatches. Keep false for strict production hygiene.
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
ALLOW_APP_DOMAIN_LOCALHOST_FALLBACK=false

# ── CI reporting (optional) ──────────────────────────────────────────────────
# Optional Codecov token for private repos / stricter upload auth.
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
CODECOV_TOKEN=

# ── Deployment workflow (deploy.yml) ────────────────────────────────────────
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
SUPABASE_ACCESS_TOKEN=
SUPABASE_DB_PASSWORD=
SUPABASE_PROJECT_ID=

# ── Cloudflare egress Worker auto-deploy ─────────────────────────────────────
# API token scopes required: Workers Scripts:Edit, Account Settings:Read
# CF_PROXY_SECRET → see EzyGo section (runtime + CI/CD, same name)
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
CLOUDFLARE_API_TOKEN=
CLOUDFLARE_ACCOUNT_ID=
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
CF_WORKER_NAME=ghostclass-backend
# Name of the Supabase browser proxy CF Worker (ISP block workaround)
# workers/supabase-proxy/index.js is deployed under this name
CF_SUPABASE_PROXY_WORKER_NAME=ghostclass-supabase-proxy

# ── AWS Lambda egress proxy auto-deploy ──────────────────────────────────────
# IAM permissions: lambda:GetFunctionConfiguration, lambda:UpdateFunctionConfiguration,
#                  lambda:UpdateFunctionCode, lambda:PublishVersion (scoped to function ARN)
# AWS_SECONDARY_SECRET → see EzyGo section (runtime + CI/CD, same name)
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
AWS_REGION=ap-south-1
AWS_LAMBDA_FUNCTION_NAME=ghostclass-ezygo-backend
# Name of the Supabase browser proxy Lambda (ISP block workaround)
# workers/supabase-proxy-aws/index.mjs is deployed under this function name
AWS_SUPABASE_LAMBDA_FUNCTION_NAME=ghostclass-supabase-proxy

# ⚠️ Name of private AWS S3 bucket to store internal release assets (.aab, mapping.txt)
# Keeps build artifacts secure and private. Requires IAM s3:PutObject permission.
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
AWS_S3_PRIVATE_BUCKET=

# ── Mobile Android release signing ───────────────────────────────────────────
# ⚠️ Base64-encoded Android release keystore used by the Flutter APK build
# Store this in GitHub Secrets as the raw base64 content of ghostclass.jks.
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
ANDROID_KEYSTORE_BASE64=

# ⚠️ Keystore password for the Android release signing key
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
ANDROID_KEYSTORE_PASSWORD=

# ⚠️ Alias of the Android release signing key
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
ANDROID_KEY_ALIAS=

# ⚠️ Password for the Android signing key alias
# 🔑 CI/CD (Infisical `/ci` folder → GitHub CI/CD)
ANDROID_KEY_PASSWORD=


# ============================================================================
# QUICK START GUIDE (Infisical Centralization)
# ============================================================================
#
# 1. Install the Infisical CLI:
#    https://infisical.com/docs/cli/overview
#
# 2. Authenticate locally:
#    infisical login
#
# 3. Provision local environment variables in-memory:
#    infisical run -- npm run dev
#    (Alternatively: infisical export > .env for legacy reference)
#
# 4. Organize Upstream Centralized Values inside Infisical Dashboard:
#    - Create project environments (Development, Staging, Production)
#    - Store variables in 3 specific path folders:
#      📁 /build-time  → Build Variables & Secrets (e.g., NEXT_PUBLIC_*, SENTRY_AUTH_TOKEN)
#      📁 /runtime     → Server Runtime Secrets (e.g., ENCRYPTION_KEY, SUPABASE_SECRET_KEY)
#      📁 /ci          → Workflow CI Credentials (e.g., COOLIFY_*, ANDROID_KEY*)
#
# 5. Enable Integrations and Runtime Credentials inside Infisical:
#    - GitHub Actions Workflows: Uses `infisical/secrets-action` directly to fetch `/build-time` variables in-memory during builds
#    - Coolify Integration: Since native integration is unsupported, provide your Machine Identity token
#      (INFISICAL_TOKEN) as an environment variable in Coolify. The container boot command wraps the
#      Infisical CLI to securely inject runtime secrets into memory at boot time.
#
# 6. Changes instantly propagate to CI/CD pipelines and runtime boot environments
#    without requiring manual synchronization scripts or disk storage.
#
# ============================================================================
# SECURITY CHECKLIST
# ============================================================================
# ✅ .env file is in .gitignore
# ✅ ENCRYPTION_KEY is exactly 64 hex characters
# ✅ CF_PROXY_SECRET differs from AWS_SECONDARY_SECRET (key-separation)
# ✅ NEXT_PUBLIC_SUPABASE_CF_PROXY_URL + NEXT_PUBLIC_SUPABASE_AWS_PROXY_URL set if ISP blocks supabase.co
# ✅ CF_SUPABASE_PROXY_WORKER_NAME + AWS_SUPABASE_LAMBDA_FUNCTION_NAME set in GH Actions Variables
# ✅ Turnstile keys are PRODUCTION keys (not 1x00...)
# ✅ SUPABASE_SERVICE_ROLE_KEY is never exposed to the browser
# ✅ All secrets are stored in environment variables (not hardcoded)
# ✅ Production secrets differ from development secrets
# ✅ Infisical `/build-time` folder stores all 🔨 Build-time vars/secrets fetched dynamically in CI
# ✅ GitHub Secrets store base workflow connection credentials (INFISICAL_*, COOLIFY_*, keys)
# ✅ Server Env Vars configured for all 🚀 Runtime vars
# ✅ CF_PROXY_SECRET / AWS_SECONDARY_SECRET use same name in .env (server) and
#    Infisical upstream storage — no duplicate variable names, Infisical centralizes both
# ✅ Derived URL variables (APP_URL, SITEMAP_URL, etc.) auto-constructed by pipeline
# ✅ GOOGLE_SERVICES_JSON_BASE64 is populated in `/build-time` folder for release APK builds
# ============================================================================