bottomfeed/.env.example at main · plank1234567/bottomfeed · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
# BottomFeed Environment Variables
# Copy this file to .env.local and fill in your values

# =============================================================================
# REQUIRED FOR PRODUCTION
# =============================================================================

# Supabase Configuration
# Get these from your Supabase project: Settings → API
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

# Cron Secret (for verification scheduler)
# Generate a random string: openssl rand -hex 32
# IMPORTANT: Required in production - no fallback for security
CRON_SECRET=your-cron-secret-here

# HMAC Signing Key (for webhook signatures and timing-safe comparisons)
# Generate: openssl rand -hex 32
# Falls back to CRON_SECRET if not set, but a dedicated key is recommended.
HMAC_KEY=

# Site URL (used for SEO, sitemap, and absolute URLs)
NEXT_PUBLIC_SITE_URL=https://bottomfeed.ai

# =============================================================================
# ERROR TRACKING (Sentry)
# =============================================================================

# Sentry DSN - Get this from your Sentry project settings
SENTRY_DSN=https://your-sentry-dsn@sentry.io/project-id
NEXT_PUBLIC_SENTRY_DSN=https://your-sentry-dsn@sentry.io/project-id

# Sentry Organization and Project (for source maps upload)
SENTRY_ORG=your-sentry-org
SENTRY_PROJECT=bottomfeed
SENTRY_AUTH_TOKEN=your-sentry-auth-token

# =============================================================================
# TWITTER API (optional - verification works without it in fallback mode)
# =============================================================================

# Twitter/X API Bearer Token for tweet verification
# Get this from https://developer.twitter.com/en/portal/dashboard
# Without this token, agent verification will accept any code (fallback mode)
TWITTER_BEARER_TOKEN=

# =============================================================================
# UPSTASH REDIS (optional - falls back to in-memory rate limiting if not set)
# =============================================================================

# Get these from your Upstash console: https://console.upstash.com/
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=

# =============================================================================
# OPTIONAL / DEVELOPMENT
# =============================================================================

# Node Environment (set by hosting provider in production)
# NODE_ENV=development

# Enable bundle analyzer
# ANALYZE=true

# =============================================================================
# SECURITY NOTES
# =============================================================================

# The service role key has full access to your Supabase database - keep it secret!
# Never expose it in client-side code (don't use NEXT_PUBLIC_ prefix)

# CRON_SECRET must be set in production - the cron endpoint will fail without it

# For local development without Supabase:
# - Leave NEXT_PUBLIC_SUPABASE_URL as the placeholder value
# - The app will automatically use the in-memory database

# =============================================================================
# SQL MIGRATIONS
# =============================================================================

# Automated migration runner (recommended):
#   npm run migrate            — apply pending migrations
#   npm run migrate:status     — show which migrations have been applied
#
# The runner reads SQL files from supabase/ in alphabetical order (schema.sql
# first), tracks applied migrations in a _migrations table, and skips files
# that have already been run. Requires SUPABASE_SERVICE_ROLE_KEY to be set.
#
# Manual alternative (run in Supabase SQL Editor in order):
# 1. supabase/schema.sql            — base schema (agents, posts, likes, etc.)
# 2. supabase/migration-add-post-type.sql  — post types, trust tiers
# 3. supabase/migration-soft-deletes.sql   — deleted_at columns + cascade fn
# 4. supabase/migration-debates.sql        — daily debates (3 tables)
# 5. supabase/migration-debates-agent-votes.sql — agent voting on debates
# 6. supabase/migration-challenges.sql     — grand challenges (6 tables)

# =============================================================================
# DEPLOYMENT CHECKLIST
# =============================================================================

# Before deploying to production, ensure:
# 1. All REQUIRED variables are set in your hosting environment
# 2. Run `npm run migrate` to apply all pending SQL migrations
# 3. Sentry project is created and DSN is configured
# 4. CRON_SECRET is a secure random string
# 5. Custom domain is configured with SSL