.env.example

# Postgres connection string used by lib/db.ts. sslmode follows libpq semantics:
# require/prefer encrypt without verifying the server certificate (fine for a
# self-signed Postgres on the same host); use verify-full when the database is
# on another host to verify against the system trust store or DATABASE_CA_CERT.
DATABASE_URL=postgresql://USER:PASSWORD@HOST:5432/DBNAME?sslmode=require

# Optional. CA certificate used to verify the Postgres server's TLS identity —
# either the PEM contents inline or a path to a .pem/.crt file. When set, the
# connection always verifies the server against that CA. When unset,
# verification is governed by sslmode.
DATABASE_CA_CERT=

# Local development only. Set this alongside sslmode=no-verify when a loopback
# Postgres uses a self-signed certificate. Never enable it across a network.
DATABASE_TLS_INSECURE=false

# Auth.js (NextAuth v5) session signing key. Generate with: openssl rand -base64 32
AUTH_SECRET=

# Google OAuth 2.0 client (Web application) credentials from console.cloud.google.com.
# Authorized redirect URIs must include:
#   https://<your-domain>/api/auth/callback/google
#   http://localhost:3000/api/auth/callback/google
AUTH_GOOGLE_ID=
AUTH_GOOGLE_SECRET=

# Optional. Anthropic key for AI note titles/summaries (Claude Haiku). If unset,
# Keep falls back to local zero-token title inference. ANTHROPIC_API_KEY also works.
ANTHROPIC_KEY=
# A configured key sends note text to Anthropic for titles/summaries. Set to
# false to keep note text local while leaving the key in place.
AI_METADATA_ENABLED=
# Override the model (default: claude-haiku-4-5-20251001).
ANTHROPIC_MODEL=

# Optional. Transactional email (Resend) for password-auth verification links.
# Without RESEND_API_KEY, verify links are only logged in development.
RESEND_API_KEY=
EMAIL_FROM="Keep <verify@your-domain>"

# Canonical app URL, used for auth callbacks and verification links.
AUTH_URL=https://your-domain

# Optional. Number of reverse proxies you operate in front of the app (Caddy in
# prod = 1). Used to pick the real client IP from the right of X-Forwarded-For,
# so a spoofed leading entry can't bypass rate limits or poison the audit log.
# Defaults to 1. Set higher only if you add another trusted hop (e.g. a CDN).
TRUSTED_PROXY_HOPS=1

# Optional. Structured-log verbosity: debug | info | warn | error.
# Defaults to info in production, debug otherwise. Logs are single-line JSON on
# stdout/stderr — in prod the `keep` systemd service streams them to journald
# (read back with: journalctl -u keep -o cat | jq).
LOG_LEVEL=

# Optional. Email of the account allowed to view the /analytics dashboard.
# Unset → the dashboard 404s for everyone (analytics are still collected).
ANALYTICS_ADMIN_EMAIL=

# Optional private image storage. Choose S3-compatible storage or Vercel Blob.
# Keep the S3 bucket private; the application streams authorized objects.
S3_BUCKET=
S3_REGION=us-east-1
S3_ENDPOINT=
S3_FORCE_PATH_STYLE=false
S3_ACCESS_KEY_ID=
S3_SECRET_ACCESS_KEY=
BLOB_READ_WRITE_TOKEN=