# Brevo (transaktionale Mails)
BREVO_API_KEY=
BREVO_SENDER_EMAIL=noreply@oemer-coskun.de
BREVO_SENDER_NAME=Ömer Coskun - IT Services
BREVO_REPLY_TO=mail@oemer-coskun.de

# Supabase
SUPABASE_SECRET_KEY=
SUPABASE_URL=
# Legacy HS256 fallback — remove after revoking the legacy JWT secret in Supabase
SUPABASE_JWT_SECRET=

# Supabase - Database (use pooler URLs via pooler.supabase.com)
DATABASE_PRIMARY_URL="" # Primary (Frankfurt)

# Read replicas — only the current region's replica is used at runtime
DATABASE_FRA_URL="" # (Frankfurt)
DATABASE_SJC_URL="" # (San Jose)
DATABASE_IAD_URL="" # (North Virginia)

# Used in drizzle-kit
DATABASE_SESSION_POOLER=

# LLMS
OPENAI_API_KEY=

# Specter (plan H4) -- main switch: only SPECTER_ENABLED=true switches it on
# (empty or false = off for every role). Switched on, not set up without a
# key (GOOGLE_AI_STUDIO_API_KEY or SPECTER_ANTHROPIC_API_KEY) and a budget
SPECTER_ENABLED=false
GOOGLE_AI_STUDIO_API_KEY=
SPECTER_GEMINI_MODEL=gemini-3.5-flash
SPECTER_GEMINI_FALLBACK_MODEL=gemini-3.5-flash-lite
SPECTER_ANTHROPIC_API_KEY=
SPECTER_MODEL=claude-sonnet-5
SPECTER_PRICE_INPUT_USD_PER_MTOK=
SPECTER_PRICE_OUTPUT_USD_PER_MTOK=
SPECTER_MONTHLY_BUDGET_USD=
SPECTER_BUDGET_THRESHOLDS=50,80,100
SPECTER_LIMIT_PER_HOUR=20
SPECTER_LIMIT_PER_DAY=100
SPECTER_IMAGES_PER_DAY=10
SPECTER_ATTACHMENT_RETENTION_DAYS=30
SPECTER_CONVERSATION_RETENTION_DAYS=90

# Config
ALLOWED_API_ORIGINS="http://localhost:3001"
LOG_LEVEL=debug
INVOICE_JWT_SECRET=
MIDDAY_ENCRYPTION_KEY=
# Licence files (docs/betrieb/lizenzdateien.md): the Ed25519 signing key,
# a PKCS#8 PEM file outside the repository (preferred), or the PEM itself
# in LICENCE_SIGNING_KEY. Empty = nothing is signed.
LICENCE_SIGNING_KID=
LICENCE_SIGNING_KEY_FILE=
# LICENCE_SIGNING_KEY=
MIDDAY_DASHBOARD_URL="http://localhost:3001"

# Environment
NODE_ENV=development

# Railway (set automatically in production)
# RAILWAY_ENVIRONMENT=production
# RAILWAY_REPLICA_REGION=europe-west4-drams3a

# Redis Cache (Upstash multi-region — reads from nearest replica, writes to primary)
REDIS_URL=redis://localhost:6379

# Google
GOOGLE_GENERATIVE_AI_API_KEY=

# Redis Queue (Railway internal — used by BullMQ)
REDIS_QUEUE_URL=redis://localhost:6379

# Logger
LOG_PRETTY=true

# File Key Secret
FILE_KEY_SECRET=secret

# Outlook
OUTLOOK_CLIENT_ID=<your-client-id>
OUTLOOK_CLIENT_SECRET=<your-client-secret>
OUTLOOK_REDIRECT_URI=http://localhost:3003/apps/outlook/oauth-callback

# Mistral
MISTRAL_API_KEY=

# Stripe
STRIPE_SECRET_KEY=your_secret_key_here
STRIPE_PUBLISHABLE_KEY=your_publishable_key_here
STRIPE_CONNECT_CLIENT_ID=your_connect_client_id_here
STRIPE_CONNECT_WEBHOOK_SECRET=your_webhook_secret_here

# Midday API URL
MIDDAY_API_URL=http://localhost:3003

# Trigger.dev
TRIGGER_SECRET_KEY=

# Internal API Key
INTERNAL_API_KEY=

# Anthropic

# Gate (Telegram-Freigabe, eigener Bot, nicht der Midday-Assistent)
GATE_TELEGRAM_BOT_TOKEN=
GATE_TELEGRAM_CHAT_ID=
GATE_TELEGRAM_WEBHOOK_SECRET=
GATE_TEAM_ID=
GATE_USER_ID=

# Portal und Aufstellung
PORTAL_BASE_URL=https://portal.oemer-coskun.de
# Required in production with MIDDAY_DASHBOARD_URL and MIDDAY_API_URL above
# (packages/utils/src/envs.ts; the API refuses to start without them).
HOMEPAGE_URL=http://localhost:3000
STATEMENT_JWT_SECRET=
# Die Rechtsangaben des Betreibers fuer die Aufstellung-PDF kommen aus
# operator_profile, nicht aus Umgebungsvariablen: Einstellungen -> Betreiberdaten.
