# Copy to deploy/.env.prod on the Droplet (git ignores .env.prod) and fill in every <...> value.
# Generate secrets with: openssl rand -hex 32

# ---- Domains
API_DOMAIN=api.notestack.ai
# Local port the host reverse proxy (Nginx) forwards API_DOMAIN to. Change it if 8010 is taken.
API_PORT=8010
ACME_EMAIL=arslan@firebird-technologies.com
ENV=production
API_URL=https://api.notestack.ai
FRONTEND_URL=https://notestackai.pages.dev
CORS_ORIGINS=https://notestackai.pages.dev

# ---- Neon Postgres
# In Neon: Dashboard > Connect. Pick the DIRECT connection (turn "Connection pooling" off: the host must NOT
# contain "-pooler"), then change the scheme from postgresql:// to postgresql+psycopg://
DATABASE_URL=postgresql+psycopg://<user>:<password>@<ep-xxxx>.<region>.aws.neon.tech/<db>?sslmode=require
# The worker checks for jobs every WORKER_POLL_SECONDS, which keeps Neon's compute awake. Raise it to cut
# compute hours (jobs then start a few seconds later).
WORKER_POLL_SECONDS=3
WORKER_CONCURRENCY=3
RUN_WORKER_IN_API=false

# ---- Secrets (new values for production, never reuse local ones)
JWT_SECRET=<openssl rand -hex 32>
INTERNAL_TOKEN=<openssl rand -hex 32>
UNSUBSCRIBE_SECRET=<openssl rand -hex 32>

# ---- Google sign in (add https://api.notestack.ai/api/auth/google/callback to the OAuth client)
GOOGLE_CLIENT_ID=<client id>
GOOGLE_CLIENT_SECRET=<client secret>
GOOGLE_REDIRECT_URI=https://api.notestack.ai/api/auth/google/callback

# ---- Email
EMAIL_PROVIDER=resend
RESEND_API_KEY=<resend key>
FROM_EMAIL=Notestack <hello@notestack.ai>
ALERTS_EMAIL=arslan@firebird-technologies.com

# ---- Files. Local disk on the Droplet (kept in the appdata Docker volume, backed up with the Droplet).
# For R2 instead: set STORAGE_BACKEND=r2 and fill the R2_* values.
STORAGE_BACKEND=local
LOCAL_STORAGE_DIR=/data/storage
CORPUS_CACHE_DIR=/data/corpus
R2_ACCOUNT_ID=
R2_ACCESS_KEY_ID=
R2_SECRET_ACCESS_KEY=
R2_BUCKET=notestack-assets
# Sharing a bucket with other apps? Keep Notestack in its own folder:
R2_PREFIX=

# ---- AI
LLM_API_KEY=<z.ai key>
ELEVENLABS_API_KEY=<elevenlabs key>
TYPESAFE_API_KEY=
FIRECRAWL_API_KEY=

# ---- Renderer (only used when started with --profile render)
RENDERER_URL=http://renderer:3100

# ---- Social publishing (optional). Redirect URIs: https://api.notestack.ai/api/social/{x,linkedin}/callback
X_CLIENT_ID=
X_CLIENT_SECRET=
LINKEDIN_CLIENT_ID=
LINKEDIN_CLIENT_SECRET=

BILLING_ENABLED=false
# Stripe. Checkout, the customer portal and webhooks. Prices are found or created by lookup key
# (notestack_<plan>_<cycle>) from backend/app/services/plans.py; set STRIPE_PRICE_* to pin existing ones.
# Webhook endpoint: {API_URL}/api/billing/webhook with events checkout.session.completed,
# checkout.session.async_payment_succeeded, checkout.session.async_payment_failed,
# customer.subscription.created, customer.subscription.updated, customer.subscription.deleted,
# customer.subscription.paused, customer.subscription.resumed, invoice.paid, invoice.payment_failed,
# invoice.payment_action_required, charge.dispute.created.
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
STRIPE_PRICE_WRITER_MONTHLY=
STRIPE_PRICE_WRITER_ANNUAL=
STRIPE_PRICE_STUDIO_MONTHLY=
STRIPE_PRICE_STUDIO_ANNUAL=