.env.example

# Connection string for the local Postgres where the handbook data lives.
# Homebrew Postgres on macOS uses your OS user with trust auth, so no password
# is needed; adjust for other setups. See CLAUDE.md §1 — this file lives at
# the repo root, not per-package.
DATABASE_URL=postgres://localhost:5432/monmap

# ---- Public site origin ----
# Canonical URLs, sitemap, robots.txt and OG image URLs resolve from this
# (packages/webapp/lib/seo.ts). On Vercel this came free from VERCEL_URL /
# VERCEL_PROJECT_PRODUCTION_URL; self-hosting on Oracle/Dokploy has no such
# auto var, so set it explicitly. It's a NEXT_PUBLIC_* value → must also be
# passed as a Docker build-arg (baked into the client bundle at build time).
NEXT_PUBLIC_SITE_URL=https://monmap.monashcoding.com

# ---- Central MAC auth (auth.monashcoding.com) ----
# MonMap consumes the central MAC identity service; it does NOT run its
# own auth server or hold OAuth secrets. Server code verifies EdDSA JWTs
# locally against the service's JWKS (packages/webapp/lib/mac-auth.ts).
#
# AUTH_URL         — read server-side (JWT issuer + JWKS endpoint).
# NEXT_PUBLIC_AUTH_URL — same value, exposed to the browser so the Better
#                    Auth react client points sign-in/out at the service.
# JWT_AUDIENCE     — expected `aud` claim on MAC tokens.
AUTH_URL=https://auth.monashcoding.com
NEXT_PUBLIC_AUTH_URL=https://auth.monashcoding.com
JWT_AUDIENCE=mac-suite

# ---- PostHog ----
# Public project token (safe to ship to the browser — PostHog API tokens
# are write-only for capture). Used by both `instrumentation-client.ts`
# and `lib/posthog-server.ts`; same value either side.
NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=
# Server-side host. The browser hits PostHog via the `/ingest/*` reverse
# proxy in next.config.mjs, so this only matters for posthog-node.
# Defaults to the US cloud when unset.
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com