.env.example

APP_NAME=Stacks
APP_ENV=development
APP_KEY=
# Pretty HTTPS URLs are the default development experience. `./buddy dev`
# routes this hostname through rpx, which uses tlsx for local certificates.
APP_URL=stacks.localhost
APP_MAINTENANCE=false
APP_MAINTENANCE_SECRET=
APP_COMING_SOON=false
APP_COMING_SOON_SECRET=

# Optional automation credential for non-interactive environments. Interactive
# users should run `./buddy setup:ssl` once instead of storing a sudo password.
# Local-only, never commit a real value because .env is gitignored.
SUDO_PASSWORD=

# .env encryption (stacksjs/stacks#1053). Generated by `buddy key:generate`.
# Public key encrypts new values (`buddy env:set`, `buddy env:encrypt`).
# Private key decrypts at runtime — keep out of source control on prod.
# Encrypted values look like `encrypted:...` or `enc:...` in this file and
# are auto-decrypted at boot by the env plugin in bunfig.toml preload.
# Leave both blank in dev; run `buddy key:generate` to materialize.
DOTENV_PUBLIC_KEY=
DOTENV_PRIVATE_KEY=

PORT=3000
DEBUG=true

DB_CONNECTION=sqlite
DB_VITESS_SHARDED=false
PREDICTHQ_DB_PASSWORD=
DB_HOST=127.0.0.1
DB_PORT=5432
DB_DATABASE=stacks
DB_USERNAME=root
DB_PASSWORD=
# DB_CONNECTION=turso: libsql://<db>-<org>.turso.io, or http://127.0.0.1:8080 for `turso dev`
TURSO_DATABASE_URL=
TURSO_AUTH_TOKEN=

STRIPE_SECRET_KEY=""
STRIPE_WEBHOOK_SECRET=""

AWS_ACCOUNT_ID=
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_PROFILE=stacks

# Filesystem / Storage
FILESYSTEM_DISK=local
# FILESYSTEM_LOCAL_ROOT=storage/app
# FILESYSTEM_PUBLIC_ROOT=public

# AWS S3 Storage
AWS_BUCKET=
AWS_S3_PREFIX=
AWS_ENDPOINT=
AWS_URL=
AWS_USE_PATH_STYLE_ENDPOINT=false

# Mail. `smtp` against the local catcher: `buddy mail:dev` runs the mail server
# with delivery switched off, so every message the app sends is accepted, stored
# and readable at http://localhost:8025 and none of it leaves the machine.
#
# It is the same binary production runs, which is the point — a message that
# renders in a separate trap program has been through a parser nothing in
# production will ever run, and the bugs that costs are the ones nobody can
# reproduce locally.
MAIL_MAILER=smtp
MAIL_HOST=127.0.0.1
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_NAME="${APP_NAME}"
MAIL_FROM_ADDRESS="no-reply@stacksjs.com"

# Queue Configuration
# Drivers: sync (default, immediate execution), database, redis, sqs, memory
QUEUE_DRIVER=sync
QUEUE_PREFIX=stacks:queue
QUEUE_CONCURRENCY=5
QUEUE_LOG_LEVEL=info
QUEUE_WORKER_CONCURRENCY=5
QUEUE_FAILED_DRIVER=database

# Queue Rate Limiting (optional)
# QUEUE_RATE_LIMIT_ENABLED=false
# QUEUE_RATE_LIMIT_MAX=100
# QUEUE_RATE_LIMIT_DURATION=1000

# Queue Dead Letter Queue (optional)
# QUEUE_DLQ_ENABLED=true
# QUEUE_DLQ_MAX_RETRIES=3

# Queue Horizontal Scaling (optional, for multi-instance deployments)
# QUEUE_HORIZONTAL_SCALING_ENABLED=false
# QUEUE_MAX_WORKERS=10
# QUEUE_JOBS_PER_WORKER=10

# Queue Metrics (optional)
# QUEUE_METRICS_ENABLED=false

# Redis Configuration (required when QUEUE_DRIVER=redis)
# REDIS_URL=
# REDIS_HOST=localhost
# REDIS_PORT=6379
# REDIS_PASSWORD=
# REDIS_DB=0

# SQS Configuration (required when QUEUE_DRIVER=sqs)
# SQS_PREFIX=
# SQS_SUFFIX=

SEARCH_ENGINE_DRIVER=meilisearch
MEILISEARCH_HOST=http://127.0.0.1:7700
MEILISEARCH_KEY=masterKey

# FRONTEND_* variables should not contain any sensitive information
FRONTEND_APP_ENV="${APP_ENV}"
FRONTEND_APP_URL="${APP_URL}"

FRONTEND_STRIPE_PUBLIC_KEY=

# ts-cloud management dashboard (auto-deployed on every server).
# Served behind HTTP Basic auth when TS_CLOUD_UI_PASSWORD is set; if left empty
# the dashboard is served WITHOUT auth (recommended: set a password).
TS_CLOUD_UI_PASSWORD=
# TS_CLOUD_UI_USERNAME=admin
# TS_CLOUD_UI_DOMAIN=dashboard.example.com
# TS_CLOUD_UI_DISABLE=

# Deploying to a Linux box you already own (config/cloud.ts `cloud.provider: 'ssh'`).
# Each of these overrides the matching field of the first entry in `ssh.hosts`,
# so CI can point at another board without editing the config.
# TS_CLOUD_SSH_HOST=pi-stacks.local
# TS_CLOUD_SSH_USER=pi
# TS_CLOUD_SSH_PORT=22
# TS_CLOUD_SSH_KEY=~/.ssh/id_ed25519
# On a private address the deploy publishes no DNS and requests no certificate.
# Set this to 1 when the box IS reachable from the internet through a port
# forward this process cannot see, or 0 to keep a public box off public DNS.
# TS_CLOUD_SSH_PUBLISH_DNS=