# Database credentials (used by both db and web services in docker-compose.yml)
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=qrmaster

# Note: DATABASE_URL and DIRECT_URL are auto-generated from POSTGRES_* vars in docker-compose.yml
# You don't need to set them here when using Docker Compose
NODE_ENV=production
PORT=3000
NEXTAUTH_URL=http://localhost:3000
NEXTAUTH_SECRET=CHANGE_ME
NEXT_PUBLIC_APP_URL=http://localhost:3000
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=
REDIS_URL=redis://redis:6379
IP_SALT=CHANGE_ME_SALT
ENABLE_DEMO=true

# SMTP & Email Senders (for welcome + retention emails via nodemailer / resend)
SMTP_HOST=smtp.qrmaster.net
SMTP_PORT=465
SMTP_USER=timo@qrmaster.net
SMTP_PASS=
EMAIL_FROM="Timo from QR Master <timo@qrmaster.net>"
EMAIL_FROM_SECURITY="QR Master Security <noreply@qrmaster.net>"
EMAIL_REPLY_TO="support@qrmaster.net"

# Cron job protection — generate with: openssl rand -base64 32
CRON_SECRET=

# Leave empty in production for 1,000 / 10,000 unique scans. Test only, e.g. 1,2.
SOCIAL_MILESTONE_THRESHOLDS=
# Leave empty for immediate publishing after consent. Set 24 to enable a revocation window.
SOCIAL_MILESTONE_POST_DELAY_HOURS=
# Hours between two brand posts (default 24). Set 0 on test to publish back to back.
SOCIAL_MILESTONE_MIN_GAP_HOURS=
SOCIAL_MILESTONE_POSTING_ENABLED=false
SOCIAL_WORKER_INTERVAL_SECONDS=10
X_API_KEY=
X_API_SECRET=
X_ACCESS_TOKEN=
X_ACCESS_TOKEN_SECRET=

# Channels the consent dialog offers (app) and the worker publishes (worker).
# Keep both in sync: x / x,instagram
SOCIAL_MILESTONE_CHANNELS=x
SOCIAL_WORKER_CHANNELS=x
# Instagram Business account for QRMaster.net, see docs/automations/social-accounts-and-jobs.md
INSTAGRAM_USER_ID=
INSTAGRAM_ACCESS_TOKEN=
GRAPH_API_VERSION=v22.0
# Guards POST/DELETE on /api/social-assets, the public image host Instagram
# pulls from. Unrelated to TikTok posting; falls back to TIKTOK_ADMIN_KEY.
SOCIAL_ASSET_ADMIN_KEY=

# TikTok OAuth / posting (server-side only)
# Source of truth for cron posting: QRMaster server .env
# Production example: https://qrmaster.net/api/tiktok/callback
# Local dev example: http://localhost:3000/api/tiktok/callback
# Tokens are saved in the DB after the OAuth callback; do not store access tokens here.
TIKTOK_CLIENT_KEY=
TIKTOK_CLIENT_SECRET=
TIKTOK_REDIRECT_URI=https://qrmaster.net/api/tiktok/callback
TIKTOK_ADMIN_KEY=
TIKTOK_EXPECTED_OPEN_ID=