env.example

SUPABASE_URL=
SUPABASE_SERVICE_ROLE_KEY=
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=

# Session signing key (HMAC). Optional: if unset, falls back to
# SUPABASE_SERVICE_ROLE_KEY. Set a dedicated long random value in production.
SESSION_SECRET=

# Initial admin/staff passwords used ONLY when first bootstrapping an empty
# database (the very first /api/seed call). Set strong values in production.
SEED_ADMIN_PASSWORD=
SEED_STAFF_PASSWORD=

# Required to enable the emergency /api/auth/reset-admin endpoint. If unset,
# that endpoint is disabled (returns 404). Send it as the x-admin-reset-secret header.
ADMIN_RESET_SECRET=

# Backups. BACKUP_SECRET must match the value set as a GitHub Actions repo secret.
BACKUP_SECRET=

# Optional S3 target for backups. If left blank, backups are returned inline
# and archived as a private GitHub Actions artifact instead.
S3_ENDPOINT=
S3_ACCESS_KEY_ID=
S3_SECRET_ACCESS_KEY=
S3_BUCKET=
S3_REGION=