# PragatiVeer backend — required & recommended environment variables.
# Copy to backend/.env and fill in real values. NEVER commit the real .env.

# --- SECURITY (required in production) ---

# Secret used to sign JWTs. Generate: python3 -c "import secrets; print(secrets.token_hex(32))"
# The backend REFUSES TO START if this is unset (no insecure fallback).
# Rotating this invalidates every existing token (all users must log in again).
JWT_SECRET_KEY=

# Admin login password for admin@pragativeer.com (used by /api/auth/login).
# Generate a long random value; rotate whenever it may have leaked.
# Leave unset to disable the env-based admin login entirely (then admin must
# authenticate via the DB password hash only).
ADMIN_PASSWORD=

# Opaque admin bearer token accepted by /api/admin/* alongside real JWTs.
# Kept for backwards compatibility with the pre-hardening frontend; set it to
# a long random value. Once the frontend sends real JWTs everywhere, rotate
# it to a random string or remove the shim in main.py.
ADMIN_TOKEN=admin

# Demo accounts password (demo@pragativeer.com etc.). Rotate in .env, never in code.
DEMO_PASSWORD=

# --- EXISTING SETTINGS (unchanged by the security hardening) ---
# DATABASE_URL=postgresql://user:pass@host:port/db
# RAZORPAY_KEY_ID= / RAZORPAY_KEY_SECRET=
# MinIO / S3 credentials for PDF storage
# SMTP settings for welcome emails