.env.example

# Server
PORT=8080
ENVIRONMENT=development
# Available services: monitor,postgres,redis,mongodb
# Phase 1: monitor only. Add postgres (Phase 2), redis (Phase 3), mongodb (Phase 4) when ready.
INSTANT_ENABLED_SERVICES=monitor

# Platform Database — stores teams, users, resources, pings, onboarding_events
# Direct connection (bypasses PgBouncer; required for advisory locks in scheduler)
DATABASE_URL=postgres://instant:instant@localhost:5432/instant_platform?sslmode=disable

# Customer Database — where provisioned db_{token} databases are created (Phase 2+)
# Separate cluster so a compromised customer DB never touches platform metadata.
# Optional in Phase 1 (monitoring only). Required from Phase 2 (Postgres provisioning).
CUSTOMER_DATABASE_URL=postgres://instant_cust:instant_cust@localhost:5433/instant_customers?sslmode=disable

# Redis
REDIS_URL=redis://localhost:6379
# Redis provisioning backend: "local" (shared Redis with ACL/namespace isolation) or "upstash"
REDIS_PROVISION_BACKEND=local
# Redis host used when building connection strings returned to clients (use "redis" in k8s)
REDIS_PROVISION_HOST=redis

# MongoDB provisioning (Phase 4)
# Admin URI for the local MongoDB instance (used to create databases and users)
MONGO_ADMIN_URI=mongodb://root:root@mongodb:27017
# MongoDB host used when building connection strings returned to clients (use "mongodb" in k8s)
MONGO_HOST=mongodb:27017

# Security
# Generate with: openssl rand -hex 32   (JWT_SECRET needs 32+ chars, AES_KEY needs exactly 64 hex chars)
JWT_SECRET=change_me_32_bytes_minimum_required_here_pad
# Replace the entire value with the output of `openssl rand -hex 32` (exactly 64 hex chars).
# The value below is a placeholder — DO NOT use as-is in any environment, including dev.
AES_KEY=REPLACE_WITH_openssl_rand_hex_32_OUTPUT_64_HEX_CHARS_REQUIRED_HERE

# MaxMind GeoLite2 (download free from maxmind.com, place in project root)
MAXMIND_LICENSE_KEY=
GEOLITE2_DB_PATH=./GeoLite2-City.mmdb

# Stripe
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=

# Resend (email)
RESEND_API_KEY=

# OAuth
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=