.env.example

# Copy to .env for local dev. Real secrets live in Dokploy env, sourced from
# role inboxes (projects@monashcoding.com). No personal accounts anywhere.

# --- Core ---
# For local docker-compose, the app talks to the `db` service on the compose network.
# For `npm run dev` (server outside docker), point at the host-mapped db port 5433.
DATABASE_URL=postgres://mac_hackathon:mac_hackathon@db:5432/mac_hackathon
PORT=3000
PUBLIC_URL=http://localhost:3000

# Local-dev auth bypass. When 1 (and NODE_ENV != production), the API accepts a
# self-issued `dev:` token so the auth-gated pages work on localhost without a
# real mac-auth session. IGNORED in production. Leave unset when deploying.
DEV_AUTH=1

# --- mac-auth (EdDSA JWTs verified locally via JWKS — never build auth) ---
MAC_AUTH_URL=https://auth.monashcoding.com
MAC_AUTH_JWKS_URL=https://auth.monashcoding.com/api/auth/jwks
JWT_AUDIENCE=mac-suite
# mac-auth roles that grant organiser access. Authorization is by ROLE, not the
# informational `team` claim. Baseline signed-in users are `member`.
ORGANISER_ROLES=committee,exec,admin

# --- Humanitix (stage 3 — club-owned account, read-only) ---
HUMANITIX_API_KEY=
HUMANITIX_API_BASE=https://api.humanitix.com/v1

# --- Notion (stage 2 — content CMS) ---
NOTION_API_KEY=
NOTION_EVENTS_DB_ID=
NOTION_PRIZES_DB_ID=
NOTION_JUDGES_DB_ID=
NOTION_SCHEDULE_DB_ID=
NOTION_SPONSORS_DB_ID=
NOTION_FAQ_DB_ID=

# --- Sync safety (stage 3) ---
FORCE_TICKET_SYNC=
TICKET_SYNC_REVOKE_THRESHOLD=0.20

# --- Optional: Discord webhook for sync-failure alerts ---
DISCORD_ALERT_WEBHOOK_URL=