.env.example

############
# Secrets
# YOU MUST CHANGE THESE BEFORE GOING INTO PRODUCTION
############

POSTGRES_PASSWORD=your-super-secret-and-long-postgres-password
JWT_SECRET=33b5d6e902102569b69844e7fffd68798c7b94d1044f56e281a701fdccdefad5
ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzgzMDkyOTgyLCJleHAiOjIwOTg0NTI5ODJ9.feaBIOsPG5bpqiRpPZixt1HT6X-D_EkGgZStEvZsaNs
SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIiwiaXNzIjoic3VwYWJhc2UiLCJpYXQiOjE3ODMwOTI5ODIsImV4cCI6MjA5ODQ1Mjk4Mn0.y7UCYcTJFA2QQX56CDGvQXEdfsFYTRqHBAGjvLggrY4

# Opaque API keys ("sb_publishable_..."/"sb_secret_...") and the asymmetric JWT
# keypair backing them. Optional - leave all four blank to keep using the
# legacy ANON_KEY/SERVICE_ROLE_KEY above (Kong's kong-entrypoint.sh falls back
# to legacy-only behavior automatically). See:
# https://supabase.com/docs/guides/self-hosting/self-hosted-auth-keys
SUPABASE_PUBLISHABLE_KEY=
SUPABASE_SECRET_KEY=
ANON_KEY_ASYMMETRIC=
SERVICE_ROLE_KEY_ASYMMETRIC=

DASHBOARD_USERNAME=supabase
DASHBOARD_PASSWORD=this_password_is_insecure_and_should_be_updated
SECRET_KEY_BASE=UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq
VAULT_ENC_KEY=your-encryption-key-32-chars-min

# Encryption key for securing connection strings used by Studio against
# postgres-meta. Required as of the 2026-06 Studio/meta versions - Studio and
# meta will fail to start without it. (Must be at least 32 characters;
# generate with: openssl rand -base64 24)
PG_META_CRYPTO_KEY=your-encryption-key-32-chars-min


############
# Database - You can change these to any PostgreSQL database that has logical replication enabled.
############

POSTGRES_HOST=db
POSTGRES_DB=postgres
POSTGRES_PORT=5432
# default user is postgres


############
# Supavisor -- Database pooler
############
POOLER_PROXY_PORT_TRANSACTION=6543
POOLER_DEFAULT_POOL_SIZE=20
POOLER_MAX_CLIENT_CONN=100
POOLER_TENANT_ID=your-tenant-id
# Pool size for internal metadata storage used by Supavisor (separate from
# the client-facing pools above)
POOLER_DB_POOL_SIZE=5


############
# API Proxy - Configuration for the Kong Reverse proxy.
############

KONG_HTTP_PORT=8000
KONG_HTTPS_PORT=8443


############
# API - Configuration for PostgREST.
############

PGRST_DB_SCHEMAS=public,storage,graphql_public
# Max number of rows returned by a request
PGRST_DB_MAX_ROWS=1000
# Extra schemas added to the search_path of every request
PGRST_DB_EXTRA_SEARCH_PATH=public


############
# Auth - Configuration for the GoTrue authentication server.
############

## General
# The Giftamizer frontend (D:\git\Giftamizer) defaults to port 3001 - keep this
# in sync with its PORT if you change either one.
SITE_URL=http://localhost:3001
ADDITIONAL_REDIRECT_URLS=http://localhost:3001/**
JWT_EXPIRY=3600
DISABLE_SIGNUP=false
API_EXTERNAL_URL=http://localhost:8000

## Mailer Config
MAILER_URLPATHS_CONFIRMATION="/auth/v1/verify"
MAILER_URLPATHS_INVITE="/auth/v1/verify"
MAILER_URLPATHS_RECOVERY="/auth/v1/verify"
MAILER_URLPATHS_EMAIL_CHANGE="/auth/v1/verify"

## Email auth
ENABLE_EMAIL_SIGNUP=true
ENABLE_EMAIL_AUTOCONFIRM=true
SMTP_ADMIN_EMAIL=admin@example.com
SMTP_HOST=supabase-mail
SMTP_PORT=2500
SMTP_USER=fake_mail_user
SMTP_PASS=fake_mail_password
SMTP_SENDER_NAME=fake_sender
ENABLE_ANONYMOUS_USERS=false

## Phone auth
ENABLE_PHONE_SIGNUP=false
ENABLE_PHONE_AUTOCONFIRM=false


############
# Studio - Configuration for the Dashboard
############

STUDIO_DEFAULT_ORGANIZATION=Default Organization
STUDIO_DEFAULT_PROJECT=Default Project

STUDIO_PORT=3000
# replace if you intend to use Studio outside of localhost
SUPABASE_PUBLIC_URL=http://localhost:8000

# Enable webp support
IMGPROXY_AUTO_WEBP=true

# Add your OpenAI API key to enable SQL Editor Assistant
OPENAI_API_KEY=


############
# Storage - Configuration for Storage
############

# S3 bucket when using S3 backend, directory name when using 'file' (default)
GLOBAL_S3_BUCKET=stub
# Used for S3 protocol endpoint configuration
REGION=stub
# Equivalent to project_ref for the S3 protocol endpoint's session token
STORAGE_TENANT_ID=stub

# Access key ID/secret for connecting to Storage's S3 protocol endpoint directly.
# Leave blank unless you're using that endpoint (generate with: openssl rand -hex 16/32)
S3_PROTOCOL_ACCESS_KEY_ID=
S3_PROTOCOL_ACCESS_KEY_SECRET=

# Used by MinIO when added via:
#   docker compose -f docker-compose.yml -f docker-compose.s3.yml up -d
MINIO_ROOT_USER=supa-storage
MINIO_ROOT_PASSWORD=secret1234


############
# Functions - Configuration for Functions
############
# NOTE: VERIFY_JWT applies to all functions. Per-function VERIFY_JWT is not supported yet.
FUNCTIONS_VERIFY_JWT=false


############
# Logs - Configuration for Logflare + Vector (Studio's Logs page)
# Only used when the docker-compose.logs.yml override is active:
#   docker compose -f docker-compose.yml -f docker-compose.logs.yml up -d
# Please refer to https://supabase.com/docs/reference/self-hosting-analytics/introduction
############

# API token for log ingestion used by Logflare and Vector.
# (Must be at least 32 characters; generate with: openssl rand -base64 24)
LOGFLARE_PUBLIC_ACCESS_TOKEN=your-super-secret-and-long-logflare-key-public
# API token used for Logflare management operations. Never expose client-side.
# (Must be at least 32 characters; generate with: openssl rand -base64 24)
LOGFLARE_PRIVATE_ACCESS_TOKEN=your-super-secret-and-long-logflare-key-private

# Docker socket location - this value will differ depending on your OS
DOCKER_SOCKET_LOCATION=/var/run/docker.sock

# Google Cloud Project details
GOOGLE_PROJECT_ID=GOOGLE_PROJECT_ID
GOOGLE_PROJECT_NUMBER=GOOGLE_PROJECT_NUMBER


############
# Giftamizer - Custom services (smtp2graph, urlmetadata)
# These are opt-in for local dev. Uncomment COMPOSE_PROFILES below (or set it
# in your shell) to start them; production sets this permanently.
############
# COMPOSE_PROFILES=giftamizer-extras

## OAuth providers (Auth service)
GOOGLE_ENABLED=false
GOOGLE_CLIENT_ID=
GOOGLE_SECRET=
GOOGLE_REDIRECT_URI=http://localhost:8000/auth/v1/callback

FACEBOOK_ENABLED=false
FACEBOOK_CLIENT_ID=
FACEBOOK_SECRET=
FACEBOOK_REDIRECT_URI=http://localhost:8000/auth/v1/callback

## smtp2graph - SMTP to Microsoft Graph email relay
SMTP2GRAPH_HTTP_PORT=8080
SMTP2GRAPH_SMTP_PORT=25
SMTP2GRAPH_CLIENT_ID=
SMTP2GRAPH_CLIENT_SECRET=
SMTP2GRAPH_TENANT_ID=
SMTP2GRAPH_DEV_MODE=true
SMTP2GRAPH_WEB_SERVER=true
SMTP2GRAPH_WEB_SERVER_MESSAGE_LIMIT=100

## urlmetadata - link preview metadata service
# NOTE: confirmed (by direct container inspection) that this image ignores PORT and
# always listens on 5500 internally, so changing this value has no effect today.
URLMETADATA_HTTP_PORT=5500

## github function - powers the Support page issue tracker
# Personal Access Token (fine-grained or classic) with Issues read/write on the target repo.
# Leave GITHUB_TOKEN blank to disable the integration - the frontend hides the Support nav
# item when it isn't configured.
GITHUB_TOKEN=
GITHUB_OWNER=ExplodedCode
GITHUB_REPO=Giftamizer

## Automated Postgres backups (prodrigestivill/postgres-backup-local)
# Add "backup" to COMPOSE_PROFILES to enable, e.g.:
#   COMPOSE_PROFILES=giftamizer-extras,backup
BACKUP_SCHEDULE=@daily
BACKUP_KEEP_DAYS=7
BACKUP_KEEP_WEEKS=4
BACKUP_KEEP_MONTHS=6

## Offsite backup (mazzolino/restic + rclone) - restic first takes local,
# encrypted, deduplicated snapshots of the pg_dumps above (./backups) and the
# Storage files (./volumes/storage) into ./volumes/restic-repo, then rclone
# mirrors that local repo to whichever remote you configure below. rclone
# supports ~70 backends (S3, B2, R2, SFTP, Google Drive, ...) - none are
# hardcoded here; you define the remote itself via `rclone config` (see
# README). Add "restic-backup" to COMPOSE_PROFILES to enable, alongside
# "backup" so there's something in ./backups to read, e.g.:
#   COMPOSE_PROFILES=giftamizer-extras,backup,restic-backup

# Generate a strong, unique password with: openssl rand -base64 32
# Do NOT lose this password - without it, none of the backed-up data is recoverable.
RESTIC_PASSWORD=

# Name (and optional path) of the rclone remote to sync to, exactly as
# defined in ./volumes/rclone/rclone.conf (create it by running
# `rclone config` - see README), e.g.:
#   RCLONE_REMOTE=b2:my-bucket-name/giftamizer
#   RCLONE_REMOTE=r2:my-bucket-name/giftamizer
#   RCLONE_REMOTE=myremote:some/path
RCLONE_REMOTE=

# 6-field cron (seconds first). Defaults: backup nightly at 3:30am, prune at 4am.
RESTIC_BACKUP_CRON=0 30 3 * * *
RESTIC_PRUNE_CRON=0 0 4 * * *
RESTIC_KEEP_DAYS=7
RESTIC_KEEP_WEEKS=4
RESTIC_KEEP_MONTHS=6