.env.example

# Core Exchange Node Example - Environment Configuration
# =============================================================================
# Copy this file to .env in the project root to configure the application.
#
# IMPORTANT SECURITY NOTES:
# - Never commit .env files to version control
# - Use different values for each environment (dev, staging, production)
# - Generate production secrets with: node scripts/secrets.js all
# - Store production secrets in a secure secret manager
# =============================================================================

# ===== SERVICE URLS =====
# These URLs must match your Caddy/proxy configuration
OP_ISSUER=https://id.localtest.me
APP_HOST=https://app.localtest.me
APP_BASE_URL=https://app.localtest.me
API_HOST=https://api.localtest.me
API_BASE_URL=https://api.localtest.me

# ===== SERVICE PORTS =====
OP_PORT=3001
APP_PORT=3004
API_PORT=3003

# ===== OAUTH CLIENT CONFIGURATION =====
# For development: Use these placeholder values
# For production: Generate with `node scripts/secrets.js client`
CLIENT_ID=dev-rp-CHANGE-FOR-PRODUCTION
CLIENT_SECRET=dev-secret-CHANGE-FOR-PRODUCTION
REDIRECT_URI=https://app.localtest.me/callback
POST_LOGOUT_REDIRECT_URI=https://app.localtest.me

# ===== APPLICATION SECRETS =====
# For development: Use this placeholder value
# For production: Generate with `node scripts/secrets.js secrets`
COOKIE_SECRET=dev-cookie-secret-CHANGE-FOR-PRODUCTION

# ===== API CONFIGURATION =====
API_AUDIENCE=api://my-api

# ===== JWKS (Token Signing Keys) =====
# For development: Leave commented (uses ephemeral keys - tokens invalidate on restart)
# For production: Generate with `node scripts/secrets.js jwks`
# JWKS='{"keys":[...]}'

# ===== MULTIPLE OAUTH CLIENTS (Optional) =====
# To register multiple OAuth clients, either:
# 1. Copy apps/auth/.env.clients.example.json to .env.clients.json
# 2. Or set this environment variable as a JSON array
# OIDC_CLIENTS=[{"client_id":"...","client_secret":"...","redirect_uris":["..."]}]

# ===== LOGGING =====
# Options: trace, debug, info, warn, error, fatal
# Use 'debug' for detailed OAuth flow logging during development
LOG_LEVEL=info

# ===== ANALYTICS =====
# Google Analytics 4 Measurement ID for the client app (e.g., G-XXXXXXXXXX)
# Leave empty to disable analytics
# GA_MEASUREMENT_ID=