adrianbonpin
ec5ee7fb18
- Add captcha plugin to Better Auth config (cloudflare-turnstile provider) - Create reusable TurnstileWidget component with script injection - Integrate Turnstile into login, signup, and forgot-password forms - Pass x-captcha-response header on protected endpoints - Add TURNSTILE_SECRET_KEY and NEXT_PUBLIC_TURNSTILE_SITE_KEY to env
113 lines
4.6 KiB
Bash
113 lines
4.6 KiB
Bash
# =============================================================================
|
|
# Environment Configuration
|
|
# =============================================================================
|
|
# Copy this file to .env.local and fill in your actual values
|
|
# Never commit .env.local to version control
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# SYSTEM & DEPLOYMENT
|
|
# -----------------------------------------------------------------------------
|
|
NIXPACKS_NODE_VERSION=22
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# DATABASE
|
|
# -----------------------------------------------------------------------------
|
|
# PostgreSQL connection string
|
|
DATABASE_URL="postgresql://user:password@localhost:5432/db"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# APPLICATION URLS
|
|
# -----------------------------------------------------------------------------
|
|
# Base URL of the application (client-accessible)
|
|
NEXT_PUBLIC_SITE_URL="https://localhost:3000"
|
|
|
|
# Auth callback URL
|
|
NEXT_PUBLIC_APP_URL="https://localhost:3000"
|
|
|
|
# Used by Better Auth trusted origins and auth client baseURL (same as NEXT_PUBLIC_SITE_URL)
|
|
NEXT_PUBLIC_BASE_URL="https://localhost:3000"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# BETTER AUTH
|
|
# -----------------------------------------------------------------------------
|
|
# Better Auth configuration
|
|
# URL must match your app URL (with protocol)
|
|
BETTER_AUTH_URL="https://localhost:3000"
|
|
|
|
# Secret key for signing tokens (generate with: openssl rand -base64 32)
|
|
BETTER_AUTH_SECRET="your-secret-key-here"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# AUTHENTICATION
|
|
# -----------------------------------------------------------------------------
|
|
# Google OAuth credentials (required)
|
|
GOOGLE_CLIENT_ID=""
|
|
GOOGLE_CLIENT_SECRET=""
|
|
|
|
# Discord OAuth credentials (required)
|
|
DISCORD_CLIENT_ID=""
|
|
DISCORD_CLIENT_SECRET=""
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# STORAGE (CLOUDFLARE R2)
|
|
# -----------------------------------------------------------------------------
|
|
R2_ACCOUNT_ID=
|
|
R2_ACCESS_KEY_ID=
|
|
R2_SECRET_ACCESS_KEY=
|
|
R2_BUCKET_NAME=deckyvault
|
|
R2_PUBLIC_URL=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# CAPTCHA (CLOUDFLARE TURNSTILE)
|
|
# -----------------------------------------------------------------------------
|
|
# Cloudflare Turnstile site key (public, used in client-side widget)
|
|
NEXT_PUBLIC_TURNSTILE_SITE_KEY="0x4AAAAAADrebUvw0DbPkPSc"
|
|
|
|
# Cloudflare Turnstile secret key (server-side verification)
|
|
TURNSTILE_SECRET_KEY="0x4AAAAAADrebeHpOUElKVG4bxd3EBbdBrk"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# CRON
|
|
# -----------------------------------------------------------------------------
|
|
# Secret token for daily cron endpoint (generate with: openssl rand -base64 32)
|
|
# Leave empty to disable cron endpoints
|
|
CRON_SECRET=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# PASSKEY (WebAuthn)
|
|
# -----------------------------------------------------------------------------
|
|
# RP ID: Your domain without protocol (e.g., "localhost" or "deckyvault.xyz")
|
|
RP_ID="localhost"
|
|
|
|
# RP Name: Human-readable name shown in passkey prompts
|
|
RP_NAME="DeckyVault"
|
|
|
|
# Android APK key hash for native passkey support on Android
|
|
# Generate with:
|
|
# keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android | grep 'SHA256:'
|
|
# Then convert to base64url format (remove colons, lowercase, base64url encode)
|
|
# Leave empty for web-only passkey support
|
|
ANDROID_APK_KEY_HASH=
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# EMAIL
|
|
# -----------------------------------------------------------------------------
|
|
# Resend API key for sending OTP emails (optional — falls back to console logging)
|
|
RESEND_API_KEY=""
|
|
|
|
# Email sender address
|
|
EMAIL_FROM="DeckyVault <noreply@deckyvault.xyz>"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# STEAMGRIDDB
|
|
# -----------------------------------------------------------------------------
|
|
# API key for SteamGridDB cover art search (get one at https://www.steamgriddb.com)
|
|
STEAMGRIDDB_API_KEY="your_steamgriddb_api_key_here"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# CONTACT FORM
|
|
# -----------------------------------------------------------------------------
|
|
# Discord webhook URL for contact/report submissions
|
|
DISCORD_WEBHOOK_URL=""
|