# MuseHub environment configuration template
# Copy to .env and fill in real values for local development.
# NEVER commit .env, .env.staging, .env.production, or .env.prod to version control.
#
# Secret generation:
#   openssl rand -hex 32   → for WEBHOOK_SECRET_KEY, RUNNER_TOKEN
#   openssl rand -hex 16   → for DB_PASSWORD
#
# Environments: local | staging | production
# NEVER set DEBUG=true in staging or production — it exposes internals.

# ── Core ─────────────────────────────────────────────────────────────────────

MUSE_ENV=local
DEBUG=true

# ── Database ──────────────────────────────────────────────────────────────────

DATABASE_URL=postgresql+asyncpg://musehub:musehub@postgres:5432/musehub
DB_PASSWORD=changeme

# ── Auth & secrets ────────────────────────────────────────────────────────────
# Generate with: openssl rand -hex 32

WEBHOOK_SECRET_KEY=changeme
RUNNER_TOKEN=changeme

# ── CORS ──────────────────────────────────────────────────────────────────────

CORS_ORIGINS=http://localhost:3000,https://localhost:1337

# ── Object storage ────────────────────────────────────────────────────────────

MUSEHUB_RELEASES_DIR=/data/releases

# ── Staging / production guidance ─────────────────────────────────────────────
# For staging and production deployments, values are injected via AWS SSM
# Parameter Store by deploy/push.sh — do not hard-code secrets here.
# Set MUSE_ENV=staging or MUSE_ENV=production and DEBUG=false.