# Production env BAKED into the backend image (no Secret Manager).
# Copy to .env.production and fill in. Keep .env.production out of git (it holds secrets).
# PORT is intentionally omitted — Cloud Run injects it (8080) and that wins over this file.
#
# IMPORTANT: the browser only ever talks to ONE origin — the FRONTEND service URL.
# The frontend (nginx) reverse-proxies /auth and /api to the backend, so the
# session cookie stays first-party. Every public URL below is the FRONTEND URL.

NODE_ENV=production

# The deployed FRONTEND service URL (set after the first deploy). The single
# public origin. Exact origin, no trailing slash.
FRONTEND_URL=https://cerebrus-frontend-XXXXXXXX-uc.a.run.app

# WorkOS — https://dashboard.workos.com
WORKOS_API_KEY=
WORKOS_CLIENT_ID=
WORKOS_COOKIE_PASSWORD=
# FRONTEND URL + /auth/callback (proxied to the backend). Register this exact URL
# as a Redirect URI in the WorkOS dashboard.
WORKOS_REDIRECT_URI=https://cerebrus-frontend-XXXXXXXX-uc.a.run.app/auth/callback

# Supabase Postgres connection string (use the pooler URI).
DATABASE_URL=

# GitHub OAuth App — https://github.com/settings/developers
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=
# FRONTEND URL + /api/github/callback (proxied to the backend). Set this exact URL
# as the OAuth App's Authorization callback URL.
GITHUB_REDIRECT_URI=https://cerebrus-frontend-XXXXXXXX-uc.a.run.app/api/github/callback

# Encrypts stored GitHub tokens at rest. openssl rand -base64 32
APP_ENCRYPTION_KEY=

# Scanner: run scans as Cloud Run Jobs in production.
SCAN_RUNNER=cloudrun
# The deployed BACKEND service URL the scanner POSTs results to.
SCAN_CALLBACK_URL=https://cerebrus-backend-XXXXXXXX-uc.a.run.app
# Shared secret the scanner sends as x-scan-secret. openssl rand -base64 32
SCAN_CALLBACK_SECRET=
# Cloud Run Job to execute (deployed via apps/cli/cloudbuild.yaml). The backend's
# service account needs run.developer + run.jobsExecutorWithOverrides on the job.
GCP_PROJECT=
GCP_REGION=us-central1
SCAN_JOB_NAME=cerebrus-scanner