.env.example

# ---------------------------------------------------------------------------
# Supabase project
# ---------------------------------------------------------------------------
# Local-only: consumed by `pnpm --filter app-backend generate-types` (supabase gen types).
# Not needed at build or runtime, so CI does not set it.
SUPABASE_PROJECT_ID=

# Read by apps/backend, by the apps/web SSR server, and — through window.CLIENT — by the
# browser. One pair for all three: everything reads them from the environment at runtime,
# so a rotated key takes effect on the next request rather than the next build.
#
# SUPABASE_ANON_KEY is deliberately the *anon* key. It is public by design: browsers
# authenticate with it and Row Level Security, not secrecy, decides what a caller may read.
# Every backend query runs through a client bound to the caller's JWT so RLS applies. A
# service role key here would bypass RLS entirely, which is why nothing asks for one.
#
# The backend validates both at startup and refuses to boot without them. In production
# they are injected into the Serverless Container via `--environment`
# (see .github/workflows/deploy.yml), never baked into the image.
SUPABASE_PROJECT_URL=
SUPABASE_ANON_KEY=

# ---------------------------------------------------------------------------
# Ports
# ---------------------------------------------------------------------------
# Express SSR server (apps/web).
PORT=5173
# NestJS backend (apps/backend). apps/web proxies /api/* here.
BACKEND_PORT=3001

# ---------------------------------------------------------------------------
# Backend container watcher (optional)
# ---------------------------------------------------------------------------
# The backend in docker-compose.dev.yml watches bind-mounted sources, and containers get
# inotify events only for files stored in the Linux filesystem — so it polls by default.
# On a Linux host, inotify works and polling is pure overhead:
# TSC_WATCHFILE=UseFsEvents
# TSC_WATCHDIRECTORY=UseFsEvents

# ---------------------------------------------------------------------------
# Backend hardening (optional — sensible defaults apply when unset)
# ---------------------------------------------------------------------------
# Comma-separated CORS allowlist. Defaults to http://localhost:5173.
CORS_ORIGINS=http://localhost:5173
# Rate limit window in ms and max requests per window per IP. Defaults: 60000 / 120.
THROTTLE_TTL=60000
THROTTLE_LIMIT=120

# ---------------------------------------------------------------------------
# S3 Access key to static content
# ---------------------------------------------------------------------------
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=ru-central1