lacrypta-dev/.env.example at main · lacrypta/lacrypta-dev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# ─── La Crypta Dev — environment variables ─────────────────────────────────
#
# Copy this file to `.env.local` (gitignored) and fill the values.
#
# Convention:
#   - NEXT_PUBLIC_ prefix → exposed to the browser, baked at build time.
#   - everything else → server-only. NEVER prefix a secret with NEXT_PUBLIC_.

# ─── Nostr identity (required) ──────────────────────────────────────────────

# Admin npub (NIP-19 bech32). Public, not a signing secret.
# This is the user allowed to request admin-only backend actions. For example,
# the browser asks this admin to sign an ephemeral request before the backend
# returns official La Crypta badge events.
NEXT_PUBLIC_LACRYPTA_ADMIN_NPUB=npub1...

# La Crypta's official publisher signing key (NIP-19 bech32 nsec).
# SERVER-ONLY. The public official pubkey is derived from this key by backend
# routes and is used as the author for official reports/results/badges.
LACRYPTA_NSEC=nsec1...

# ─── Email login (required for magic links) ─────────────────────────────────

# Public app origin used to build email magic links.
NEXT_PUBLIC_SITE_URL=http://localhost:3000

# Comma-separated exact HTTPS callback URLs outside *.lacrypta.dev that may
# receive email-login magic links. Subdomains such as
# https://figus.lacrypta.dev/auth/lacrypta-email are allowed automatically.
# EMAIL_LOGIN_ALLOWED_CALLBACK_URLS=https://figus.world/auth/lacrypta-email

# Resend API key and verified sender. Server-only.
RESEND_API_KEY=re_...
RESEND_FROM_EMAIL="La Crypta Dev <login@lacrypta.dev>"

# ─── Events subscription (optional) ─────────────────────────────────────────

# Upstream La Crypta CRM subscribe endpoint that backs POST /api/events-subscribe.
# Server-only proxy target. Defaults to the org-scoped public endpoint
# https://crm.lacrypta.ar/api/public/organizations/la-crypta/subscriptions when
# unset (the old events.lacrypta.ar/api/subscribe now fails with "Organization
# context required"). Read by: app/api/events-subscribe/route.ts.
# EVENTS_SUBSCRIBE_URL=https://crm.lacrypta.ar/api/public/organizations/la-crypta/subscriptions

# CRM contact list UUID(s) to subscribe contacts into (comma-separated for
# several). Forwarded as the `list_ids` array to the subscribe endpoint. Copy IDs
# from the CRM at /dashboard/lists. Defaults to the main newsletter list.
EVENTS_SUBSCRIBE_LISTS=0135a251-8a46-4f88-b5bc-315d982eb7fa

# ─── Cache revalidation (required for /api/revalidate-nostr) ────────────────

# Shared secret that gates POST /api/revalidate-nostr.
# Read by: app/api/revalidate-nostr/route.ts.
# The endpoint flushes the `nostr:hackathon-submissions` cache tag so SSR
# project pages, dynamic OG images, and the Nostr sitemap pick up new
# community submissions. Send the value as `x-revalidate-secret` header.
REVALIDATE_SECRET=change-me

# ─── Upstash Redis cache (optional, recommended in prod) ────────────────────

# Persistent read-through cache for the expensive Nostr relay scans (6s for the
# full project snapshot). Sits under the `"use cache"` layer: a cold start or a
# tag revalidation reads Upstash (~50ms) instead of re-scanning the relays, so
# crawlers never wait on a cold render. SERVER-ONLY — never NEXT_PUBLIC_.
# Read by: lib/upstashCache.ts. Unset → the cache no-ops (plain relay scan).
# Copy both values from the Upstash console ("REST API" section).
# On Vercel these are provisioned automatically by the Upstash marketplace
# integration, which injects them as KV_REST_API_URL / KV_REST_API_TOKEN —
# lib/upstashCache.ts accepts either pair, so nothing extra is needed there.
# UPSTASH_REDIS_REST_URL=https://<db>.upstash.io
# UPSTASH_REDIS_REST_TOKEN=...

# Force the cache off while leaving the credentials in place.
# UPSTASH_CACHE_DISABLED=1

# Keys are namespaced `lacrypta:<dev|preview|prod>:…` off VERCEL_ENV, and a build
# with NEXT_PUBLIC_DEV_MODE or a localhost relay is forced to `dev:` regardless.
# So pointing a dev build at the shared Upstash database can never serve dummy
# projects to production, and preview deploys cannot poison production's keys.

# ─── Cache warming (gates GET /api/cache/warm) ──────────────────────────────

# Shared secret for the warming endpoint, sent as `Authorization: Bearer <...>`.
# Vercel Cron injects that header automatically when CRON_SECRET is set on the
# project. The cron rescans the relays and refreshes Upstash in the background,
# so the 6s scan never lands inside a user or crawler request.
# Read by: app/api/cache/warm/route.ts. Unset → the endpoint returns 503.
CRON_SECRET=change-me

# ─── Local dev environment (optional, DEV ONLY) ─────────────────────────────
#
# Isolated testing: a local relay + throwaway dev key + in-app impersonation.
# See AGENTS.md ("Local dev environment"). Run `pnpm gen:dev-keys` to generate
# the keypair, then `pnpm relay:up` to start the local relay — it health-checks
# the relay (publish + read-back + NIP-33 replacement) and fails loudly rather
# than reporting success for a relay that is not actually serving.
#
# ⚠ NEVER set any NEXT_PUBLIC_DEV_* / NEXT_PUBLIC_NOSTR_RELAYS in production —
# they expose impersonation UI and a signing secret to the browser. Leave all
# of these unset in prod; the app falls back to real relays and hides the bar.

# Turn on the DEV MODE bar (account impersonation, one-click admin login).
# NEXT_PUBLIC_DEV_MODE=true

# Route ALL Nostr publish/read traffic to a relay set (comma-separated).
# Point at the local relay so nothing reaches public relays.
# NEXT_PUBLIC_NOSTR_RELAYS=ws://localhost:7777

# Browser-side admin secret for the bar's "Entrar como La Crypta" button.
# Must be the nsec whose npub equals NEXT_PUBLIC_LACRYPTA_ADMIN_NPUB above.
# In dev, set LACRYPTA_NSEC + NEXT_PUBLIC_LACRYPTA_ADMIN_NPUB to this same
# throwaway keypair (all three come from `pnpm gen:dev-keys`).
# NEXT_PUBLIC_DEV_ADMIN_NSEC=nsec1...