.env.local.example

# AdCP Registry - Environment Configuration Template
# Copy this file to .env.local and fill in your values

# ============================================================================
# SERVER CONFIGURATION
# ============================================================================

# Server port (default: 3000)
# Note: In Conductor workspaces, CONDUCTOR_PORT is automatically assigned during setup
# and overrides this value. Mintlify docs use CONDUCTOR_PORT + 1.
PORT=3000
# CONDUCTOR_PORT=<auto-assigned-port>

# Environment: development | production
NODE_ENV=development

# Server mode: http | mcp (stdio)
MODE=http

# Log level: trace | debug | info | warn | error | fatal
# Default: debug in development, info in production
LOG_LEVEL=debug

# ============================================================================
# DATABASE CONFIGURATION (Required)
# ============================================================================

# PostgreSQL connection string (REQUIRED)
# Format: postgresql://username:password@host:port/database
# Note: Port is automatically assigned by Docker and written to .env.local during setup
# Example for local development:
DATABASE_URL=postgresql://adcp:localdev@localhost:<auto-assigned-port>/adcp_registry

# Enable SSL for database connection (default: false)
DATABASE_SSL=false

# Verify SSL certificates when SSL is enabled (default: true)
DATABASE_SSL_REJECT_UNAUTHORIZED=true

# Connection pool settings (direct Postgres connection).
# Total connections = num_processes * DATABASE_POOL_MAX.
# Ensure total doesn't exceed Postgres max_connections (check with SHOW max_connections).
DATABASE_POOL_MAX=20
DATABASE_POOL_MIN=5
DATABASE_CONNECTION_TIMEOUT_MS=5000
DATABASE_IDLE_TIMEOUT_MS=30000

# ============================================================================
# AUTHENTICATION - WorkOS (Required for Registry Features)
# ============================================================================

# WorkOS API Key (REQUIRED)
# Get this from: https://dashboard.workos.com/api-keys
# Format: sk_live_... or sk_test_...
WORKOS_API_KEY=sk_test_your_api_key_here

# WorkOS Client ID (REQUIRED)
# Get this from: https://dashboard.workos.com/configuration
# Format: client_...
WORKOS_CLIENT_ID=client_your_client_id_here

# Session encryption secret (REQUIRED, min 32 characters)
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
WORKOS_COOKIE_PASSWORD=generate_a_random_32_character_secret_here

# OAuth callback URL (default: http://localhost:3000/auth/callback)
# Update this for production to use https:// and your domain
WORKOS_REDIRECT_URI=http://localhost:3000/auth/callback

# Admin access control (comma-separated list of email addresses)
# Users with these emails will have access to /admin/* endpoints
# ADMIN_EMAILS=admin@example.com,owner@example.com

# Admin API Key (for programmatic admin access without browser session)
# Generate with: node -e "console.log('aao_' + require('crypto').randomBytes(32).toString('base64url'))"
# Use as: Authorization: Bearer <key>
# ADMIN_API_KEY=aao_your_secret_key_here

# Allow insecure cookies for local development (HTTP instead of HTTPS)
# Set to true when running locally with Docker over HTTP
# ALLOW_INSECURE_COOKIES=true

# ============================================================================
# BILLING - Stripe (Optional, required for subscriptions)
# ============================================================================

# Stripe Secret Key
# Get this from: https://dashboard.stripe.com/apikeys
# Format: sk_test_... or sk_live_...
# STRIPE_SECRET_KEY=sk_test_your_stripe_secret_key

# Stripe Publishable Key
# Format: pk_test_... or pk_live_...
# STRIPE_PUBLISHABLE_KEY=pk_test_your_stripe_publishable_key

# Stripe Pricing Table ID (for team/organization subscriptions)
# Get this from: https://dashboard.stripe.com/pricing-tables
# Format: prctbl_...
# STRIPE_PRICING_TABLE_ID=prctbl_your_pricing_table_id

# Stripe Pricing Table ID for individual subscriptions (optional)
# If not set, falls back to STRIPE_PRICING_TABLE_ID
# STRIPE_PRICING_TABLE_ID_INDIVIDUAL=prctbl_your_individual_pricing_table_id

# Stripe Webhook Secret (for webhook signature verification)
# Get this from: https://dashboard.stripe.com/webhooks
# Format: whsec_...
# STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret

# Invoice-Based Payments Configuration (via Stripe Lookup Keys)
# Products available for invoice requests are determined by Stripe prices with
# lookup keys starting with 'aao_invoice_'. No env vars needed - products are
# fetched dynamically from Stripe.
#
# To add invoice-able products:
# 1. Create a product in Stripe Dashboard
# 2. Add a price with a lookup_key like 'aao_invoice_membership_10k'
# 3. Set product metadata: category='membership', display_name='Company Membership ($10,000)'
# 4. The product will automatically appear in the invoice request form

# ============================================================================
# NOTIFICATIONS - Slack (Optional)
# ============================================================================

# Slack Incoming Webhook URL for member event notifications
# Get this from: https://api.slack.com/messaging/webhooks
# Creates notifications for: new subscriptions, payments, cancellations
# SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T.../B.../...

# ============================================================================
# SLACK APP INTEGRATION (Optional, for user mapping features)
# ============================================================================

# Slack Bot Token (required for user sync and DM features)
# Get this from: https://api.slack.com/apps > Your App > OAuth & Permissions
# After installing to workspace, copy "Bot User OAuth Token"
# Format: xoxb-...
# SLACK_BOT_TOKEN=xoxb-your-bot-token

# Slack Signing Secret (required for webhook verification)
# Get this from: https://api.slack.com/apps > Your App > Basic Information
# Under "App Credentials" > "Signing Secret"
# SLACK_SIGNING_SECRET=your-signing-secret

# Required Bot Token Scopes:
# - chat:write (send DMs)
# - im:write (open DM channels)
# - users:read (list users)
# - users:read.email (get user emails for auto-mapping)

# ============================================================================
# MOLTBOOK INTEGRATION (Optional, for AI agent social network)
# ============================================================================

# Moltbook API Key (enables Addie's presence on Moltbook)
# Get this from: https://www.moltbook.com after registering Addie
# Format: moltbook_sk_...
# MOLTBOOK_API_KEY=moltbook_sk_your_api_key_here

# Enable/disable Moltbook posting (default: true if API key is set)
# Set to false to disable posting while keeping monitoring active
# MOLTBOOK_ENABLED=true

# Slack channel for Moltbook updates is configured via the admin UI
# Go to /admin/notification-channels and create a channel named "Moltbook"

# ============================================================================
# NOTIFICATIONS - Email (Optional)
# ============================================================================

# Resend API Key for transactional emails (welcome emails, etc.)
# Get this from: https://resend.com/api-keys
# Sends: welcome email to new members after subscription
# RESEND_API_KEY=re_...

# YouTube Data API v3 key (for importing YouTube channels into brand collections)
# Get this from: https://console.cloud.google.com/apis/credentials
# Free tier: 10,000 quota units/day
# YOUTUBE_API_KEY=AIza...

# Spotify Web API credentials (for importing podcast episodes into brand collections)
# Get this from: https://developer.spotify.com/dashboard
# SPOTIFY_CLIENT_ID=
# SPOTIFY_CLIENT_SECRET=

# ============================================================================
# PRODUCTION DEPLOYMENT NOTES
# ============================================================================
#
# 1. HTTPS is REQUIRED in production for secure cookie transmission
#    - Set NODE_ENV=production to enable secure cookies
#    - Use a reverse proxy (nginx, Caddy, cloud load balancer) for TLS
#    - Update WORKOS_REDIRECT_URI to use https://
#
# 2. Generate strong secrets for production:
#    - WORKOS_COOKIE_PASSWORD: min 32 characters, cryptographically random
#    - Never commit real secrets to version control
#
# 3. Database:
#    - Use SSL in production (DATABASE_SSL=true)
#    - Ensure DATABASE_URL uses strong password
#    - Pool settings tunable via DATABASE_POOL_MAX, DATABASE_POOL_MIN, DATABASE_IDLE_TIMEOUT_MS
#
# 4. Stripe keys:
#    - Use live keys (sk_live_..., pk_live_...) in production
#    - Configure webhook endpoint in Stripe dashboard
#    - Test webhooks with Stripe CLI before deploying
#
# 5. Monitoring:
#    - Set LOG_LEVEL=info in production
#    - Configure log aggregation (CloudWatch, Datadog, etc.)
#    - Monitor connection pool stats in application logs
#