.env.example

# ─── Backend (.env at repo root — read by the openstudy container) ─────────

# Bootstrap-only: scripts/seed_operator_password.py reads this on each deploy
# to set users.password_hash for the operator account. It only writes the hash
# if the existing DB row has none — so redeploying never clobbers a password
# you changed through the UI. Generate the hash with:
#   uv run python -m app.tools.hashpw
APP_PASSWORD_HASH=

# Random secret for session signing. REQUIRED — app refuses to start without one.
# Generate with:
#   python3 -c 'import secrets; print(secrets.token_urlsafe(48))'
SESSION_SECRET=

# Expose FastAPI's auto-generated /api/docs + /api/openapi.json. Default OFF.
# Set to `true` only in dev — the schema is recon assist for any attacker.
EXPOSE_DOCS=false

# Comma-separated list of origins allowed to hit the API in CORS.
CORS_ORIGINS=http://localhost:5173

# Public URL of your deployed app. Used to construct OAuth callbacks and MCP
# resource identifiers. Leave blank in local dev — it's derived from the
# inbound request when unset.
PUBLIC_URL=

# Where course files live on disk. The openstudy container bind-mounts this
# path; storage operations (browse, upload, delete) read/write here.
STUDY_ROOT=/opt/courses

# Shared secret for /api/internal/* endpoints (used by webhook callers and
# cron jobs). Generate with:
#   python3 -c 'import secrets; print(secrets.token_urlsafe(32))'
INTERNAL_API_SECRET=

# Telegram bot integration:
# TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID / TELEGRAM_WEBHOOK_SECRET were
# removed in v0.7.0 — the platform is multi-tenant and operator credentials
# must not be borrowed by other users. Each user configures their own
# bot token, chat ID, and webhook secret via the Settings UI; secrets are
# stored encrypted per-user in the `user_secrets` table.

# Symmetric encryption key for at-rest per-user secrets (Telegram tokens, etc.).
# REQUIRED for production — the app will refuse Telegram operations without it.
# Mint once with:
#   python3 -c 'from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())'
SECRETS_ENCRYPTION_KEY=

# Operator identity. scripts/seed_operator_password.py reads these on every
# deploy to reconcile the operator row in the users table. Set OPERATOR_EMAIL
# to your login address before the first deploy — that is the username you
# will use at /login. OPERATOR_USER_ID and OPERATOR_DISPLAY_NAME are optional.
OPERATOR_USER_ID=00000000-0000-0000-0000-000000000001
OPERATOR_EMAIL=
OPERATOR_DISPLAY_NAME=Operator

# Email backend. Default 'console' prints email bodies to stdout (fine for
# local dev and testing). For real email delivery:
#   EMAIL_BACKEND=gmail_smtp
#   GMAIL_SMTP_USER=you@gmail.com
#   GMAIL_SMTP_APP_PASSWORD=<16-char app password from myaccount.google.com/apppasswords>
EMAIL_BACKEND=console
GMAIL_SMTP_USER=
GMAIL_SMTP_APP_PASSWORD=
EMAIL_FROM=hello@openstudy.dev
EMAIL_FROM_NAME=OpenStudy

# Allow public registration. Default false — only the operator account (seeded
# from OPERATOR_EMAIL above) can log in. Set to true to open signup.
SIGNUPS_ENABLED=false

# ─── Frontend (web/.env.production for prod, web/.env.local for dev) ───────

# In dev, the frontend talks to the backend at the URL below; in production,
# leave this empty so the app uses same-origin requests through Caddy/nginx.
VITE_API_BASE_URL=http://localhost:8000

# Public URL + display name. Consumed by:
#   - canonical / OG / JSON-LD / twitter tags in index.html
#   - robots.txt, sitemap.xml, manifest.webmanifest (regenerated on build)
# Set these to your own domain + name when self-hosting so search engines
# don't treat your instance as a duplicate of someone else's.
VITE_SITE_URL=https://your-domain.tld
VITE_SITE_NAME=OpenStudy

# Show the public marketing landing page at `/`. Self-hosters typically
# want false so `/` goes straight to the app (and /login if not signed in).
VITE_SHOW_LANDING=false

# ─── Compose-time vars (.env.docker — separate file, never committed) ─────
# These belong in a SEPARATE file at .env.docker, not here, because compose
# substitutes them into docker-compose.yml at parse time. The example
# values are documented here for completeness:
#
#   POSTGRES_USER=openstudy
#   POSTGRES_PASSWORD=<generate with: openssl rand -hex 24>
#   POSTGRES_DB=openstudy
#
#   # Public identity baked into the frontend image at build time.
#   # Set to YOUR domain so canonical / OG / sitemap / manifest point at
#   # your deploy, not someone else's. Defaults to http://localhost:8080
#   # if unset (fine for first-run dev, wrong for production).
#   PUBLIC_SITE_URL=https://your-domain.tld
#   PUBLIC_SITE_NAME=OpenStudy
#   PUBLIC_SHOW_LANDING=false
#
#   # Google Search Console verification token — paste the value of
#   # `content="..."` from Search Console's "HTML tag" verification method,
#   # then ./deploy.sh to rebuild the frontend with the token baked into
#   # <meta name="google-site-verification">. Leave empty until you've added
#   # your domain at https://search.google.com/search-console/.
#   PUBLIC_GOOGLE_SITE_VERIFICATION=