.env.example

# Copy to .env. Never commit .env.

# --- R2 token for the exporter (Cloudflare dashboard -> R2 -> Manage API tokens; needs write to upload) ---
CLOUDFLARE_S3=https://<account-id>.r2.cloudflarestorage.com
CLOUDFLARE_ACCESS_ID=
CLOUDFLARE_SECRET=
R2_BUCKET=aqi-data

# --- query service (api/) ---
GATEWAY_SECRET=            # same value as the Worker's ORIGIN_SECRET
PARQUET_DIR=/data/parquet  # or s3://aqi-data to read R2 directly

# --- R2 token for the query service on Cloud Run (read-only on aqi-data is enough) ---
# Cloud Run gets these as CLOUDFLARE_S3 / CLOUDFLARE_ACCESS_ID / CLOUDFLARE_SECRET (docs/DEPLOY_API.md, section 2)
R2_S3_ENDPOINT=https://<account-id>.r2.cloudflarestorage.com
R2_ACCESS_KEY_ID=
R2_SECRET_ACCESS_KEY=

# --- exporter (maintainers only) ---
POSTGRES_URL=postgresql://user:password@host:5432/db

# --- operator conveniences, not used by any container ---
CLOUDFLARE_API_TOKEN=      # for `wrangler deploy` (Workers, D1, R2 permissions)
AQI_ADMIN_SECRET=          # the Worker's ADMIN_SECRET, for the /admin page and admin API calls