.env.production.example

# WaveStream production environment template.
# Copy this file to a private secret store or host-level .env file.
# Never commit real production values.

NODE_ENV=production
WAVESTREAM_IMAGE_TAG=main

# Public origins
FRONTEND_URL=https://music.example.com
NEXT_PUBLIC_API_URL=https://api.music.example.com
NEXT_PUBLIC_MINIO_URL=https://media.music.example.com
MINIO_PUBLIC_URL=https://media.music.example.com

# Host bindings for reverse proxy targets
WEB_BIND=127.0.0.1
WEB_PORT=3000
API_BIND=127.0.0.1
API_PORT=4000
MINIO_BIND=127.0.0.1
MINIO_API_PORT=9000
MINIO_CONSOLE_BIND=127.0.0.1
MINIO_CONSOLE_PORT=9001

# Database
DB_USER=wavestream
DB_PASSWORD=replace-with-a-long-random-database-password
DB_NAME=wavestream

# Object storage
MINIO_ROOT_USER=replace-with-random-storage-access-key
MINIO_ROOT_PASSWORD=replace-with-a-long-random-storage-secret-key

# JWT and session security
JWT_ACCESS_SECRET=replace-with-at-least-32-random-characters-access
JWT_REFRESH_SECRET=replace-with-at-least-32-random-characters-refresh
JWT_ACCESS_EXPIRY=15m
JWT_REFRESH_EXPIRY=7d

# SMTP
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USER=apikey-or-username
SMTP_PASSWORD=replace-with-real-smtp-secret
SMTP_FROM=WaveStream <noreply@example.com>

# Initial admin account
ADMIN_EMAIL=admin@example.com
ADMIN_PASSWORD=replace-with-a-strong-admin-password
ADMIN_DISPLAY_NAME=WaveStream Admin
ADMIN_USERNAME=wavestream-admin
DEFAULT_CREATOR_ROLE=creator

# Log retention for Docker json-file logs
LOG_MAX_SIZE=10m
LOG_MAX_FILE=5