# Copy to an untracked .env. Every secret below is a placeholder.
APP_ENV=development
PORT=8080
PUBLIC_BASE_URL=https://account.osglab.com
INVITE_BASE_URL=https://osglab.com/i
APP_STORE_URL=https://apps.apple.com/app/id0000000000
IMAGE_TAG=local
ACCOUNT_BIND_PORT=18080
ACCOUNT_DOCKER_NETWORK=account-backend

# Existing isolated MySQL 8.4 database.
DATABASE_URL=jdbc:mysql://mysql:3306/osg_account?useUnicode=true&characterEncoding=utf8&connectionTimeZone=UTC&forceConnectionTimeZoneToSession=true
DATABASE_USER=osg_account
DATABASE_PASSWORD=replace-with-a-random-password
DATABASE_POOL_SIZE=10
DATABASE_MIGRATION_USER=osg_account_migrator
DATABASE_MIGRATION_PASSWORD=replace-with-a-separate-migration-password

# Generate three independent secrets. Never reuse any of them.
JWT_ISSUER=https://account.osglab.com
JWT_AUDIENCE=osgkeyboard-ios
JWT_SECRET=replace-with-at-least-32-random-bytes
ACCESS_TOKEN_MINUTES=15
REFRESH_TOKEN_DAYS=30
GATEWAY_GRANT_DAYS=30
FIELD_ENCRYPTION_KEY=replace-with-exactly-32-random-bytes-as-base64
IDENTITY_HMAC_KEY=replace-with-a-distinct-32-random-bytes-as-base64
IDENTITY_TOMBSTONE_RETENTION_DAYS=365

# Apple identifiers are not secrets, but use the values from your own developer account.
APPLE_TEAM_ID=replace-with-apple-team-id
APPLE_KEY_ID=replace-with-apple-key-id
APPLE_CLIENT_ID=replace.with.your.bundle.id
# Encode PEM newlines as literal \n when supplied through Compose/1Panel.
APPLE_PRIVATE_KEY_PEM=replace-with-p8-content-using-literal-backslash-n
APPLE_JWKS_URL=https://appleid.apple.com/auth/keys
APPLE_TOKEN_URL=https://appleid.apple.com/auth/token
APPLE_REVOKE_URL=https://appleid.apple.com/auth/revoke
APPLE_INTEGRITY_ENVIRONMENT=development
APP_ATTEST_CHALLENGE_TTL_SECONDS=300
# DeviceCheck reuses the configured Apple Team ID, Key ID and ES256 private key.

# Prefer the newer Volcengine API key. The legacy app ID/access token pair is optional.
VOLCENGINE_API_KEY=replace-with-volcengine-api-key
VOLCENGINE_APP_ID=
VOLCENGINE_ACCESS_TOKEN=
VOLCENGINE_RESOURCE_ID=volc.seedasr.sauc.duration
VOLCENGINE_ASR_ENDPOINT=wss://openspeech.bytedance.com/api/v3/sauc/bigmodel_async

DEEPSEEK_API_KEY=replace-with-deepseek-api-key
DEEPSEEK_MODEL=deepseek-v4-flash
DEEPSEEK_ENDPOINT=https://api.deepseek.com/v1

SIGNUP_TRIAL_CREDITS=1000
REFERRAL_INVITER_CREDITS=3000
REFERRAL_INVITEE_CREDITS=3000
REFERRAL_BINDING_DAYS=7

# Production startup requires both flags and the production Apple environment.
ENFORCE_DEVICE_CHECK=false
ENFORCE_APP_ATTEST=false
LOG_LEVEL=INFO