.env.example

DATABASE_URL=postgres://rwf:rwf_dev_password@localhost:5432/rwf_demo
RUST_LOG=info
# Dev-only password for the gateway's `/auth/login`. The E2E test suite
# posts exactly this value (see `e2e-tests/tests/gateway_test.rs::TEST_PASSWORD`),
# so changing one without the other breaks the suite.
ADMIN_PASSWORD=synthetic-gateway-test-password
GATEWAY_PORT=3001
LIVE_SEARCH_PORT=3000
# Where the live-search test fixture finds the Leptos build artifacts.
# Run `cargo leptos build -p live-search` first; the output goes to
# `live-search/target/site/pkg` by default.
LIVE_SEARCH_PKG_DIR=./live-search/target/site/pkg

# EdDSA JWT Keys
# -----------------
# The gateway uses Ed25519 (EdDSA) for JWT signing and verification.
# Provide the keys via environment variables, or use `--dev-keys` to
# generate an ephemeral keypair at startup (development only).
#
# Option A: Ephemeral dev keys (development only)
#   Run: ALLOW_DEV_KEYS=1 cargo run -p gateway-example -- --dev-keys
#   Both ALLOW_DEV_KEYS=1 AND --dev-keys are required (defence in depth).
#   The keypair is generated fresh each time; only FNV-1a fingerprints are
#   logged. The PEM never appears in any log.
#
# Option B: Environment variables (production)
#   Generate a keypair with OpenSSL:
#     openssl genpkey -algorithm ED25519 -outform PEM -out private.pem
#     openssl pkey -in private.pem -pubout -outform PEM -out public.pem
#
#   Then export the PEM content:
#   JWT_PRIVATE_KEY_PEM=$(cat private.pem)
#   JWT_PUBLIC_KEY_PEM=$(cat public.pem)
#
#   NOTE: PEM values contain newlines. When using a .env file, wrap
#   the value in single quotes so the shell preserves the newlines.
#
# Example (development-only fixed keypair — do not use in production):
# JWT_PRIVATE_KEY_PEM='-----BEGIN PRIVATE KEY-----
# MC4CAQAwBQYDK2VwBCIEIBQp7/pzR0ZY+DVFTZ0x/WH6O8HeBolXGUdMX2v2XGxO
# -----END PRIVATE KEY-----'
# JWT_PUBLIC_KEY_PEM='-----BEGIN PUBLIC KEY-----
# MCowBQYDK2VwAyEADUoZlDcoIxgvgbwvhFsqI1C6iz7ZeQYW2n1waRedVd8=
# -----END PUBLIC KEY-----'
#
# Access-token lifetime (default 900 = 15 minutes, short by design).
# ACCESS_TOKEN_TTL_SECS=900