69 lines
3.4 KiB
Markdown
69 lines
3.4 KiB
Markdown
# Environment Variables
|
|
|
|
Complete reference for all environment variables used by the backend and frontend.
|
|
|
|
---
|
|
|
|
## Backend (`backend/.env`)
|
|
|
|
Copy `backend/.env.example` to `backend/.env` and fill in all required values before starting the API or worker. See [[01 - Local Setup]] for the full setup sequence.
|
|
|
|
| Variable | Required | Description |
|
|
|---|---|---|
|
|
| `DATABASE_URL` | Yes | PostgreSQL connection string. Format: `postgresql://user:pass@localhost:5432/dbname` |
|
|
| `REDIS_URL` | Yes | Redis connection string. Format: `redis://:password@localhost:6379` |
|
|
| `JWT_SECRET` | Yes | Secret for signing access tokens. Use a long random string. |
|
|
| `JWT_REFRESH_SECRET` | Yes | Secret for signing refresh tokens. Must differ from `JWT_SECRET`. |
|
|
| `GOOGLE_CLIENT_ID` | Yes | Google OAuth app client ID |
|
|
| `GOOGLE_CLIENT_SECRET` | Yes | Google OAuth app client secret |
|
|
| `GOOGLE_CALLBACK_URL` | Yes | OAuth redirect URL. Local: `http://localhost:3001/api/v1/auth/google/callback` |
|
|
| `TOKEN_ENCRYPTION_KEY` | Yes | Exactly 32 characters. AES-256 key for encrypting YouTube OAuth tokens in the DB. **If this changes, all channel connections break.** |
|
|
| `FRONTEND_URL` | Yes | Frontend origin for OAuth redirect. Local: `http://localhost:3000` |
|
|
| `PORT` | No | API port. Default: `3001` |
|
|
| `NODE_ENV` | No | `development` or `production` |
|
|
| `CONFLICT_DETECTION_ENABLED` | No | Global kill switch for the scheduled remote-conflict sweep. Default: `false`. Only takes effect on the worker process; the API doesn't read it. Per-team opt-in still required via `Team.conflictDetectionEnabled`. See [[05 - Queue System]]. |
|
|
| `CONFLICT_DETECTION_CRON` | No | Cron pattern (BullMQ format) for the sweep. Default: `0 3 * * *` (daily at 03:00 UTC). Only read when `CONFLICT_DETECTION_ENABLED=true`. |
|
|
|
|
### Example `backend/.env`
|
|
|
|
```env
|
|
DATABASE_URL=postgresql://studioflow:yourpassword@localhost:5432/studioflow
|
|
REDIS_URL=redis://:yourpassword@localhost:6379
|
|
JWT_SECRET=a-very-long-random-string-for-access-tokens
|
|
JWT_REFRESH_SECRET=a-different-very-long-random-string-for-refresh-tokens
|
|
GOOGLE_CLIENT_ID=123456789-abc.apps.googleusercontent.com
|
|
GOOGLE_CLIENT_SECRET=GOCSPX-yourGoogleSecret
|
|
GOOGLE_CALLBACK_URL=http://localhost:3001/api/v1/auth/google/callback
|
|
TOKEN_ENCRYPTION_KEY=exactly32characterslongkeyhere!!
|
|
FRONTEND_URL=http://localhost:3000
|
|
PORT=3001
|
|
NODE_ENV=development
|
|
CONFLICT_DETECTION_ENABLED=false
|
|
CONFLICT_DETECTION_CRON=0 3 * * *
|
|
```
|
|
|
|
---
|
|
|
|
## Frontend (`frontend/.env.local`)
|
|
|
|
Create `frontend/.env.local` manually (it is not committed to git and has no `.example` counterpart).
|
|
|
|
| Variable | Required | Description |
|
|
|---|---|---|
|
|
| `NEXT_PUBLIC_API_URL` | Yes | Backend API base URL. Local: `http://localhost:3001/api/v1` |
|
|
|
|
### Example `frontend/.env.local`
|
|
|
|
```env
|
|
NEXT_PUBLIC_API_URL=http://localhost:3001/api/v1
|
|
```
|
|
|
|
---
|
|
|
|
## Security Notes
|
|
|
|
- Never commit `.env` or `.env.local` files to git — both are already listed in `.gitignore`
|
|
- `TOKEN_ENCRYPTION_KEY` must remain stable for the entire lifetime of the database. Rotating it invalidates all stored YouTube OAuth tokens, requiring every channel to be re-authenticated. See [[04 - Gotchas]] for more detail.
|
|
- Use distinct values for `JWT_SECRET` and `JWT_REFRESH_SECRET` — reusing the same secret across both token types weakens the separation between access and refresh token validation
|
|
- In production, use a secrets manager or CI/CD secret injection rather than plain `.env` files
|