project-spacex/.env.example at main · OpencodeNIT-R/project-spacex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# =====================================================================================================
# Innovision 2026 · environment template
# Copy to `.env` (or `.env.local`) and fill in. Real env files are git-ignored: never commit secrets.
#
# Anything prefixed NEXT_PUBLIC_ is bundled into the browser JS and is PUBLIC. Every other variable is
# server-only: never rename a secret to NEXT_PUBLIC_*.
# =====================================================================================================


# --- ImageKit (event posters and gallery images ONLY; payment proofs use Supabase Storage) ---------
# Dashboard -> Developer options -> API keys

# Required. URL endpoint, e.g. https://ik.imagekit.io/<your_imagekit_id>
# Also used in the Content-Security-Policy img-src.
IMAGEKIT_URL_ENDPOINT=

# Required (public value). Used by the server-side ImageKit SDK.
IMAGEKIT_PUBLIC_KEY=

# Required. SECRET, server-only: can upload and delete any file in the ImageKit account.
IMAGEKIT_PRIVATE_KEY=

# Optional, informational only (the <id> part of the URL endpoint). Not read by the app.
IMAGEKIT_ID=

# Optional fallbacks, only read if the variables above are unset:
# NEXT_PUBLIC_IMAGEKIT_URL_ENDPOINT=
# NEXT_PUBLIC_IMAGEKIT_PUBLIC_KEY=


# --- Supabase (auth + database API) ------------------------------------------------------------------
# Dashboard -> Project Settings -> API

# Required (public). Project URL, e.g. https://<project-ref>.supabase.co
# Also used in the Content-Security-Policy connect-src.
NEXT_PUBLIC_SUPABASE_URL=

# Required (public). Publishable / anon key. Safe in the browser because RLS (supabase/schema.sql) is enforced.
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=
# Legacy alias, read only if the publishable key above is unset:
# NEXT_PUBLIC_SUPABASE_ANON_KEY=

# Required in production. SECRET, server-only: bypasses Row Level Security for the backend API routes, and is the
# only key that can sign the short-lived staff links to payment screenshots in the private `payment-proofs` bucket.
# Dashboard -> Project Settings -> API -> service_role / secret key
SUPABASE_SERVICE_ROLE_KEY=
# Legacy alias, read only if SUPABASE_SERVICE_ROLE_KEY is unset:
# SUPABASE_SERVICE_KEY=


# --- Entry passes (QR check-in at the venue) --------------------------------------------------------------
# Required for entry passes. SECRET, server-only: 32 random bytes, base64. Encrypts each participant's QR token at rest
# so POST /api/pass can show the owner the same QR on any device (the database only stores the token's SHA-256 plus
# this ciphertext). Generate with:
#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
# Set it once and keep it: changing it makes every QR already shown undecryptable (admins would have to reissue them).
# Use a different value per environment (production, preview, local/test).
ENTRY_PASS_ENCRYPTION_KEY=


# --- Site identity and search engines -------------------------------------------------------------------

# Optional (public). The ONE canonical origin of the site (src/config/site.ts), no trailing slash. Used for canonical
# URLs, Open Graph URLs, robots.txt, sitemap.xml and structured data, and as the site Google sign-in returns to
# (local dev on localhost always returns to localhost). Defaults to https://www.innonitrkl.com.
# To move to another domain: set it here AND in Vercel (Production), add it under Supabase -> Authentication ->
# URL Configuration, then redeploy (metadata, robots.txt and sitemap.xml are built at deploy time).
# NEXT_PUBLIC_SITE_URL=https://www.innonitrkl.com

# Optional (server-only). Google Search Console "HTML tag" verification: only the token, i.e. the content="..." value
# of the <meta name="google-site-verification"> tag Search Console gives you. Unset: no tag is rendered.
# GOOGLE_SITE_VERIFICATION=


# --- Direct Postgres connection (local tooling only) -------------------------------------------------
# For connecting to the database from this machine, e.g. applying supabase/schema.sql or running psql:
#   psql "$DATABASE_URL" -f supabase/schema.sql
# Dashboard -> Connect -> Connection string. SECRET: full database access with the database password.
# Not needed by the Next.js app at runtime; do NOT add it to the hosting provider or to any NEXT_PUBLIC_ variable.
#
# Session pooler (port 5432; works over IPv4, recommended for running SQL scripts from a laptop):
#   postgresql://postgres.<project-ref>:<db-password>@aws-0-<region>.pooler.supabase.com:5432/postgres?sslmode=require
# Direct connection (IPv6 unless the IPv4 add-on is enabled):
#   postgresql://postgres:<db-password>@db.<project-ref>.supabase.co:5432/postgres?sslmode=require
# URL-encode special characters in the password (e.g. @ -> %40, # -> %23, / -> %2F).
DATABASE_URL=


# --- Set automatically; do not define manually --------------------------------------------------------
# NODE_ENV  (development / production; set by `next dev` / `next build` / `next start`)
# CI        (set by GitHub Actions)