# Database — PostgreSQL connection string. prisma/schema.prisma is fixed to the
# postgresql provider, so this must point at a real Postgres instance (local
# install, Docker container, or managed service) — a SQLite file path won't work.
DATABASE_URL="postgresql://user:password@localhost:5432/craft2prints?schema=public"

# Stripe — get these from https://dashboard.stripe.com/apikeys
STRIPE_SECRET_KEY="sk_live_or_test_..."
STRIPE_WEBHOOK_SECRET="whsec_..."

# Public base URL of your deployed site (used for Stripe redirect URLs)
NEXT_PUBLIC_SITE_URL="https://yourdomain.com"

# Your admin login credentials, checked on the /admin/login page.
# CHANGE THESE before deploying — the defaults are public in this codebase.
ADMIN_USER="admin"
ADMIN_PASSWORD="changeme"

# Signs your admin login session (separate from the customer login below).
# Any long random string works — e.g. run `openssl rand -base64 32` in a terminal,
# or just mash the keyboard for 40+ characters. CHANGE THIS before deploying.
ADMIN_SESSION_SECRET="replace-with-a-long-random-string"

# Signs customer account login sessions (separate from the admin login above).
# Any long random string works — e.g. run `openssl rand -base64 32` in a terminal,
# or just mash the keyboard for 40+ characters. CHANGE THIS before deploying.
SESSION_SECRET="replace-with-a-long-random-string"

# SMTP — used to email customers their design-approval link directly.
# Leave SMTP_HOST blank to skip emailing; you'll just get a link to copy/send yourself.
# Example values for Gmail: host smtp.gmail.com, port 587, user your address,
# password an "app password" (not your normal Gmail password).
SMTP_HOST=""
SMTP_PORT="587"
SMTP_USER=""
SMTP_PASSWORD=""
MAIL_FROM="Craft2Prints <hello@yourdomain.com>"

# Where "new photo request" alerts get sent when a customer submits a photo at
# /custom-request. Leave blank to default to SMTP_USER (your SMTP login address).
ADMIN_NOTIFY_EMAIL=""

# Optional — lets the "Share via Messenger" button work. See README's
# "Sharing via Messenger" section for how to get this. Leave blank to hide that button
# (WhatsApp sharing works with no setup either way).
NEXT_PUBLIC_FACEBOOK_APP_ID=""

# Cloudflare Turnstile — CAPTCHA on the custom-request, registration, newsletter,
# and contact forms. Get a free site key + secret at https://dash.cloudflare.com
# (Turnstile section). Leave both blank to skip CAPTCHA entirely — forms work
# normally, just unprotected.
NEXT_PUBLIC_TURNSTILE_SITE_KEY=""
TURNSTILE_SECRET_KEY=""