.env.example

DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/messfit
# Celery workers (deletion sweep, OCR processing, notifications) connect as
# messfit_worker (BYPASSRLS) instead — they run on a schedule with no
# authenticated user in context and legitimately need cross-user access.
# Migration 013 creates both messfit_app/messfit_worker with no password set
# (set one via the Supabase SQL editor, never commit a real credential here).
# Optional: falls back to DATABASE_URL, which is fine for local dev's single
# throwaway Postgres role — set this explicitly once you've split roles.
# postgresql+asyncpg://messfit_worker:<password>@<host>/<db>
CELERY_DATABASE_URL=
REDIS_URL=redis://localhost:6379/0

# Supabase project URL: https://<project-ref>.supabase.co
SUPABASE_URL=https://xxx.supabase.co
# Supabase project ref (the subdomain from SUPABASE_URL — used to build the JWKS URL)
SUPABASE_PROJECT_REF=xxx
# Legacy HS256 secret — only used as fallback if your project still issues HS256 tokens.
# Modern Supabase projects use ES256 with JWKS and don't need this.
SUPABASE_JWT_SECRET=...
# Service-role key (backend-only). Used for Storage upload/download/signing of
# mess-menu OCR photos in the private 'mess-menu-photos' bucket. Never expose to the client.
SUPABASE_SERVICE_ROLE_KEY=...

GEMINI_API_KEY=...
GROQ_API_KEY=...

CORS_ORIGINS=["http://localhost:3000"]
ENVIRONMENT=development

# ── Observability + hardening (Phase 9). All optional — empty/default = no-op. ──

# OpenTelemetry traces (OTLP/HTTP, e.g. Grafana Cloud Tempo). No endpoint = no export.
OTEL_EXPORTER_OTLP_ENDPOINT=
# OTLP headers in W3C "key=value,key=value" form (e.g. Authorization=Basic%20<base64>)
OTEL_EXPORTER_OTLP_HEADERS=

# Sentry DSN — empty disables error reporting (no events shipped).
SENTRY_DSN=

# Rate limiting. In-memory by default; set to the Redis URL in production so
# limits are shared across workers. RATE_LIMIT_ENABLED=false turns it off.
RATE_LIMIT_ENABLED=true
RATE_LIMIT_STORAGE_URI=memory://