.env.example

# =============================================================================
# SentinelView — Environment Variable Template
# =============================================================================
# Copy this file to .env and fill in real values.
# NEVER commit the actual .env file to version control.
#
# Production: set these in the Render.com and Vercel dashboards instead.
# =============================================================================

# -----------------------------------------------------------------------
# Backend (Render.com Web Service)
# -----------------------------------------------------------------------

# JWT signing secret. Minimum 32 cryptographically random characters.
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
JWT_SECRET_KEY=REPLACE_WITH_32_PLUS_RANDOM_CHARS

# Demo credentials loaded at runtime — never stored in the database.
# ALLOWED_PASSWORD must be a bcrypt hash, not plaintext.
# Generate with: python -c "from passlib.hash import bcrypt; print(bcrypt.hash('yourpassword'))"
ALLOWED_USERNAME=demo
ALLOWED_PASSWORD=$2b$12$REPLACE_WITH_BCRYPT_HASH

# Exact frontend origin for CORS. No trailing slash. No wildcard.
# Example: https://sentinelview.vercel.app
FRONTEND_ORIGIN=http://localhost:3000

# SQLite database file path (relative to backend/ dir on Render disk).
# This file is excluded from git. It is wiped on new Render deploys.
DB_PATH=./sentinel.db

# -----------------------------------------------------------------------
# Generator (run locally — never deployed)
# -----------------------------------------------------------------------

# Full URL of the backend ingest endpoint.
INGEST_URL=http://localhost:8000/api/v1/ingest

# -----------------------------------------------------------------------
# Frontend (Next.js on Vercel)
# -----------------------------------------------------------------------
# Set in Vercel dashboard, NOT in this file for production.
# NEXT_PUBLIC_ prefix = safe to expose to the browser.
# Do NOT add NEXT_PUBLIC_ prefix to secrets (JWT_SECRET_KEY must stay server-side).

# Backend base URL (used by Next.js server components and API routes).
NEXT_PUBLIC_API_BASE_URL=http://localhost:8000