.env.dev.example

# Dev .env template — copy to .env.dev (no edits required for local dev).
#
#   cp .env.dev.example .env.dev
#
# These values are dev-only and ship with the repo on purpose so a fresh
# checkout works after `cp` alone. Every secret literal contains either
# `dev-only-not-for-production` or `_dev` so a misuse in a real environment
# is greppable. NEVER reuse any of these values in production — see
# .env.prod.example for the prod template (which requires operator-rotated
# secrets).
#
# Used by:
#   - host-side `pnpm dev` / Prisma (via the backend/.env -> ../.env.dev symlink)
#   - dev compose: docker compose -f docker-compose.yml -f build/dev.compose.yml --env-file .env.dev up

# --- Database ---
DB_USER=article30
DB_PASSWORD=article30_secret
DATABASE_URL=postgresql://article30:article30_secret@localhost:5432/article30

# --- Redis ---
# REDIS_URL must embed the password (Redis is started with `requirepass`).
REDIS_URL=redis://:article30_redis_dev@localhost:6379
REDIS_PASSWORD=article30_redis_dev

# --- Session / audit ---
SESSION_SECRET=dev-only-not-for-production-32chars-minimum
AUDIT_HMAC_SECRET=dev-only-not-for-production-32chars-minimum

# --- Runtime ---
NODE_ENV=development
COOKIE_SECURE=false

# --- Logging (blank LOG_LEVEL / LOG_PRETTY → debug + pretty in dev) ---
LOG_LEVEL=
LOG_PRETTY=
LOG_HTTP=true

# --- S3 / object storage (RustFS) ---
S3_ENDPOINT=http://localhost:9000
S3_BUCKET=article30-documents
S3_ACCESS_KEY=article30_s3_access_dev
S3_SECRET_KEY=article30_s3_secret_dev
S3_REGION=us-east-1

# --- HTTP origins ---
CORS_ORIGIN=http://localhost:3000
NEXT_PUBLIC_API_URL=http://localhost:3001
FRONTEND_URL=http://localhost:3000

# --- SMTP (targets MailPit; the dev compose overlay starts it) ---
SMTP_ENABLED=true
SMTP_HOST=localhost
SMTP_PORT=1025
SMTP_USER=
SMTP_PASS=
SMTP_FROM=article30-dev@localhost

# Default email locale when Accept-Language is missing/unparseable (en | fr)
MAIL_DEFAULT_LOCALE=en