.env.example

# AFFOG Backend — Environment Configuration
# Copy this file to .env and fill in the values
# ALL variables are OPTIONAL — the server runs without any of them

# Gemini AI (for AI-powered letter generation; falls back to built-in template engine)
GEMINI_API_KEY=your_gemini_api_key_here

# Supabase (for persistent database; falls back to in-memory JSON store)
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your_supabase_anon_key_here
DATABASE_URL=postgresql://postgres:password@your-project.supabase.co:5432/postgres

# JWT Secret (for auth tokens; has a built-in default for development)
JWT_SECRET=your_jwt_secret_here
ADMIN_BOOTSTRAP_TOKEN=optional_admin_creation_token

# Quotas (phase 1 defaults)
FREE_DAILY_LETTERS=15
FREE_MONTHLY_LETTERS=120
NGO_DAILY_LETTERS=200
NGO_MONTHLY_LETTERS=3000
ANON_DAILY_LETTERS=2
AUTH_RATE_LIMIT_PER_HOUR=20
LETTER_RATE_LIMIT_PER_HOUR=25
FEEDBACK_RATE_LIMIT_PER_HOUR=20

# Permit ingestion scheduler (safe fail-open background sync)
ENABLE_PERMIT_SYNC=false
PERMIT_SYNC_INTERVAL_MINUTES=360
INCLUDE_STATIC_PERMITS=false
REAL_PERMITS_ONLY=true
RUN_GLOBAL_PENDING_SYNC_ON_START=false
RUN_UK_PENDING_SYNC_ON_START=false
UK_PENDING_PERMIT_SEARCH_LIMIT=200
UK_PENDING_PERMIT_CONSULTATION_PAGES=8
UK_PENDING_PERMIT_CONTENT_CONCURRENCY=8
UK_PENDING_PERMIT_HTTP_TIMEOUT_MS=15000
UK_PENDING_PERMIT_HTTP_RETRIES=1
GLOBAL_PENDING_INCLUDE_NON_FARM=true

# Server
PORT=3000
NODE_ENV=production

# CORS — comma-separated list of allowed origins
ALLOWED_ORIGINS=https://openpermit.vercel.app
TRUST_PROXY=true
STRICT_SECURITY_HEADERS=true