# Preview environment shape (flotilla SPEC §15) — TEST values only.
#
# These are the env vars a per-PR preview boots with. The operator loads them
# into flotilla's PREVIEW overlay layer (NOT the base overlay, NOT secrets):
#
#     while IFS='=' read -r k v; do
#       [ -n "$k" ] && case "$k" in \#*) ;; *) \
#         flotilla-core overlay set <deployment> "$k=$v" --preview ;; esac
#     done < deploy/preview/preview.env.example
#
# CRITICAL (§15 / §3 invariant 1): a preview resolves ZERO real secret bytes.
# Every value here is synthetic or a documented public test value. None is a
# real credential. Do NOT bind real `secret_refs` for previews.

# --- Turnstile: Cloudflare's documented ALWAYS-PASS test keys (public) -------
# Site key is also baked into the image at build time (Dockerfile ARG); the
# secret key here makes server-side verification always succeed.
CLOUDFLARE_TURNSTILE_SECRET=1x0000000000000000000000000000000AA
VITE_TURNSTILE_SITE_KEY=1x00000000000000000000AA

# --- Email: a catch-all SMTP sink (run Mailpit/Inbucket as a sidecar/service)-
# No mail leaves the preview; everything lands in the sink's web UI.
SMTP_HOST=mailpit
SMTP_PORT=1025
SMTP_STARTTLS=0
SMTP_PASSWORD=preview-sink-no-auth
EMAIL_FROM=preview@preview.invalid
EMAIL_FROM_NAME=RFC App (preview)

# --- Analytics: no-op'd -------------------------------------------------------
VITE_AMPLITUDE_API_KEY=

# --- App identity / required env (synthetic) ---------------------------------
# These satisfy backend/app/config.py's required vars with non-secret test
# values. SECRET_KEY is a throwaway — sessions in an ephemeral preview need a
# key, not a SECRET one. GITEA_* point at whatever read surface the preview
# uses; for a content-light framework-PR preview the seeded synthetic DB
# carries the visible state and Gitea need not be reachable.
SECRET_KEY=preview-throwaway-not-a-secret-0000000000
GITEA_URL=https://git.wiggleverse.org
GITEA_BOT_USER=preview-bot
GITEA_BOT_TOKEN=preview-not-a-real-token
GITEA_ORG=preview
GITEA_WEBHOOK_SECRET=preview-webhook-not-a-secret
OAUTH_CLIENT_ID=preview-oauth-client
OAUTH_CLIENT_SECRET=preview-oauth-not-a-secret
# APP_URL: set to the Cloud Run service URL once `preview up` reports it, if the
# app's OAuth redirect / absolute-URL building needs it for your review flow.
APP_URL=http://localhost:8080