.env.local.example

# Database (Docker MySQL)
# Use 127.0.0.1 instead of localhost for cross-platform compatibility (IPv6 issues on macOS)
DATABASE_URL="mysql://prfc_user:prfc_password@127.0.0.1:3306/prfc_portal"

# Docker MySQL Configuration
MYSQL_ROOT_PASSWORD=rootpassword
MYSQL_DATABASE=prfc_portal
MYSQL_USER=prfc_user
MYSQL_PASSWORD=prfc_password

# Email (Brevo REST API)
# BREVO_API_KEY=your-brevo-api-key-here
FROM_EMAIL=noreply@example.com
# DAILY_EMAIL_LIMIT=300

# Email Feature Flag (disabled by default)
EMAIL_ENABLED=false

# Token Authentication (shared secret with PRFC portal)
# Not required for local dev - uses built-in dev secret
# PRFC_PORTAL_SECRET=your-32-char-minimum-secret-here

# Member Portal login URL
# Used by /unauthorized and the logout action
# Defaults to https://pasofoodcooperative.coop/accounts/ when unset
# PRFC_PORTAL_LOGIN_URL=https://pasofoodcooperative.coop/accounts/

# SMS Feature Flag (disabled by default)
SMS_ENABLED=false
# TWILIO_ACCOUNT_SID=ACxxxxx
# TWILIO_AUTH_TOKEN=your-auth-token
# TWILIO_FROM_NUMBER=+18051234567

# Member Portal API Integration
# Set to true for local development with mock data
# Set to false for production with real Member Portal API
USE_MOCK_MEMBER_API=true

# Required when USE_MOCK_MEMBER_API=false: the PHP actions endpoint and the
# getmembercontacts service secret
# PRFC_PORTAL_API_URL=https://www.pasofoodcooperative.coop/accounts/actions/
# MEMBER_API_SECRET=your-getmembercontacts-service-secret

# Email Unsubscribe Token Secret (32 characters minimum)
UNSUBSCRIBE_SECRET=your-32-character-secret-here-change-in-production

# Field-Level Encryption Keys (64-char hex strings, 256-bit)
# Generate with: openssl rand -hex 32
FIELD_ENCRYPTION_KEY=your-64-char-hex-key-here
BLIND_INDEX_KEY=your-64-char-hex-key-here

# Application Base URL (for generating unsubscribe links)
APP_URL=http://localhost:3000

# Rate Limiting and Email Quota (Upstash Redis)
# UPSTASH_REDIS_REST_URL=https://your-instance.upstash.io
# UPSTASH_REDIS_REST_TOKEN=your-token

# Cron Job Authentication
# CRON_SECRET=your-cron-secret-here

# Vercel Blob (profile photos)
# Required in Vercel production. Optional locally if you do not exercise photo upload.
# BLOB_READ_WRITE_TOKEN=your-blob-token-here