.env.example

# Multi-Tenant Webhook API - Environment Variables Template
# ==========================================================
# Safe template for local development and demos.
# Copy this file to .env and replace placeholder values.
# Do not commit real credentials or production values.

# Application
ENV=development
LOG_LEVEL=INFO
TZ=Europe/Stockholm

# Public/example URLs
PUBLIC_BASE_URL=http://localhost:8000
DASHBOARD_BASE_URL=http://localhost:3000
AUTOMATION_BASE_URL=http://localhost:5678

# JWT / API auth
JWT_SECRET=dev_jwt_secret_CHANGE_IN_PRODUCTION
JWT_EXPIRES_MINUTES=60

# Webhook signing secret
HMAC_SECRET=dev_hmac_secret_CHANGE_IN_PRODUCTION

# Database
DATABASE_URL=postgresql+psycopg://webhook:devpass@db:5432/webhook_api
DB_POOL_SIZE=5
DB_MAX_OVERFLOW=5
DB_POOL_RECYCLE=1800
DB_POOL_TIMEOUT=30
DB_CONNECT_TIMEOUT=10
DB_SSL_MODE=prefer

# Redis
REDIS_URL=redis://redis:6379/0
REDIS_PASSWORD=local_redis_password_change_me

# Admin / observability tokens
METRICS_TOKEN=local_metrics_token_change_me
TENANT_ADMIN_TOKEN=local_admin_token_change_me

# CORS & trusted hosts
ALLOWED_ORIGINS=*
ALLOWED_HEADERS=*
TRUSTED_HOSTS=*

# Sentry / error monitoring (optional)
SENTRY_DSN=
SENTRY_TRACES_SAMPLE_RATE=0.1
SENTRY_PROFILES_SAMPLE_RATE=0.0

# Production notes
# - Use strong generated values for JWT_SECRET, HMAC_SECRET, METRICS_TOKEN, and TENANT_ADMIN_TOKEN.
# - Use HTTPS-only PUBLIC_BASE_URL in production.
# - Store real values in a secrets manager or deployment environment.
# - Never commit real .env files.