.env.example

# =============================================================================
# Void eID Environment Variables
# =============================================================================
# Copy this file to .env and fill in your values:
#   cp .env.example .env
# =============================================================================

# Discord OAuth2 Credentials
# Get these from: https://discord.com/developers/applications
DISCORD_CLIENT_ID=your_discord_client_id
DISCORD_CLIENT_SECRET=your_discord_client_secret
DISCORD_REDIRECT_URI=http://localhost:5038/api/auth/discord/callback

# JWT Secret for signing tokens
# Generate a strong random secret (e.g., openssl rand -base64 32)
JWT_SECRET=your_jwt_secret_minimum_32_characters

# Secret pepper for hashing denylisted identifiers.
# Generate a strong random string (e.g., openssl rand -base64 32)
# Since state.rs uses .expect() this is REQUIRED for the backend to start.
IDENTITY_HASH_PEPPER=your_random_pepper_string

# Frontend URL for CORS and redirects
FRONTEND_URL=http://localhost:5173

# (Optional) Discord User ID for initial admin
INITIAL_ADMIN_ID=
# (Optional) IDs of Super Admins (comma-separated)
# Grants access to sensitive admin actions and audit logs
SUPER_ADMIN_DISCORD_IDS=

# (Optional) Database URL
# Defaults to sqlite:void-eid.db?mode=rwc if not set
DATABASE_URL=sqlite:void-eid.db?mode=rwc

# (Optional) Port to listen on
# Defaults to 5038
PORT=5038

# (Optional) Discord Webhook for Super Admin Audit Alerts
SUPER_ADMIN_AUDIT_WEBHOOK=

# (Optional) Tribe required for Mumble access
# Defaults to "Fire" if not set
MUMBLE_REQUIRED_TRIBE=Fire

# =============================================================================
# REQUIRED Security Secrets
# =============================================================================
# Generate strong random secrets using: openssl rand -base64 32
# The application will FAIL TO START if these are not set.

# REQUIRED: Shared secret for Backend-to-Murmur authenticator API calls
# Must match the INTERNAL_SECRET in the Murmur authenticator
INTERNAL_SECRET=

# REQUIRED (if running Mumble): ICE secrets for Murmur server communication
# Must match the values in Murmur configuration
ICE_SECRET_READ=
ICE_SECRET_WRITE=

# Frontend Configuration (if running frontend locally with this .env)
# URL of the backend API
VITE_API_URL=http://localhost:5038