.env.example

# ---------------------------------------------------------------------------
# MAC central auth service — environment template.
# Copy to `.env` and fill in. NEVER commit the real .env.
# Secrets live in the committee password manager under projects@monashcoding.com.
# ---------------------------------------------------------------------------

# Public base URL of this service (used as JWT issuer and OAuth redirect base).
# Locally you can use http://localhost:3000
BETTER_AUTH_URL=https://auth.monashcoding.com

# Long random secret for Better Auth (sessions, state signing).
# Generate: openssl rand -base64 32
BETTER_AUTH_SECRET=replace-me-with-openssl-rand-base64-32

# --- Postgres (self-hosted) ---
# IMPORTANT: keep the password URL/shell-safe — letters and digits only. Characters
# like $ @ : / # break Docker/Dokploy env interpolation and the assembled DATABASE_URL.
# Generate a safe one: openssl rand -hex 24
POSTGRES_USER=mac_auth
POSTGRES_PASSWORD=replace-me-hex-only-no-special-chars
POSTGRES_DB=mac_auth

# --- Google OAuth ---
# Redirect URI to register: https://auth.monashcoding.com/api/auth/callback/google
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# --- Microsoft OAuth (tenant "common" — personal + work/school accounts) ---
# Redirect URI to register: https://auth.monashcoding.com/api/auth/callback/microsoft
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=

# Origins allowed to initiate auth flows (comma-separated).
TRUSTED_ORIGINS=https://monmap.monashcoding.com,https://jobs.monashcoding.com

# JWT audience claim MAC apps verify against.
JWT_AUDIENCE=mac-suite