.env.example

# Thirsty's Waterfall - Environment Variables Template
# 
# SECURITY WARNING: Never commit actual secrets to version control!
# This is a template file showing which environment variables can be configured.
# Copy this file to .env and set your actual values (ensure .env is in .gitignore)

# =============================================================================
# SECRET MANAGEMENT GUIDELINES
# =============================================================================
# 
# PRODUCTION REQUIREMENTS:
# 1. Never hardcode secrets in source code
# 2. Load all secrets from environment variables or secure vault systems
# 3. Rotate secrets regularly (at least every 90 days)
# 4. Use different secrets for dev/staging/production environments
# 5. Revoke and rotate immediately if a secret is exposed
# 6. Use strong, cryptographically random values (minimum 32 bytes)
# 
# RECOMMENDED SECRET MANAGEMENT SOLUTIONS:
# - HashiCorp Vault
# - AWS Secrets Manager
# - Azure Key Vault
# - Google Cloud Secret Manager
# - Kubernetes Secrets
# - Environment variables in CI/CD (GitHub Actions, GitLab CI, etc.)
# 
# =============================================================================

# -----------------------------------------------------------------------------
# Demo/Testing Secrets (DOS Trap Demo)
# -----------------------------------------------------------------------------
# These are ONLY for running demos and tests. Do NOT use in production!
# If not set, the demo will generate random values automatically.
#
# To generate secure values, use Python:
#   python -c "import secrets, base64; print(base64.b64encode(secrets.token_bytes(32)).decode())"

# Master encryption key for demo (base64 encoded, minimum 32 bytes recommended)
# DEMO_MASTER_ENCRYPTION_KEY=

# Master signing key for demo (base64 encoded, minimum 32 bytes recommended)
# DEMO_MASTER_SIGNING_KEY=

# Root key for demo (base64 encoded, minimum 32 bytes recommended)
# DEMO_ROOT_KEY=

# User password for demo (plaintext string for demo purposes only)
# DEMO_USER_PASSWORD=

# API token for demo (plaintext string for demo purposes only)
# DEMO_API_TOKEN=

# -----------------------------------------------------------------------------
# Production Secrets (Example - customize for your deployment)
# -----------------------------------------------------------------------------

# Database credentials
# DB_HOST=localhost
# DB_PORT=5432
# DB_NAME=thirstys_waterfall
# DB_USER=
# DB_PASSWORD=

# Web/API secrets
# SECRET_KEY=
# JWT_SECRET_KEY=

# Web admin authentication.
# Production login is disabled until both values are set.
# Generate a password hash with:
#   python -c "from werkzeug.security import generate_password_hash; print(generate_password_hash('replace-this-password'))"
# THIRSTYS_ADMIN_USERNAME=
# THIRSTYS_ADMIN_PASSWORD_HASH=
#
# Demo login is disabled by default. Do not enable this in production.
# THIRSTYS_ALLOW_DEMO_LOGIN=false
# THIRSTYS_DEMO_USERNAME=admin
# THIRSTYS_DEMO_PASSWORD=admin
#
# Optional shared JWT revocation store.
# Set this to a writable SQLite path shared by every web worker/container that
# serves the same API environment.
# JWT_REVOCATION_DB_PATH=/home/thirsty/.thirstys_waterfall/revoked_tokens.sqlite3

# Optional local enhanced Thirsty-Lang integration.
# Set this to a checkout or installed source tree containing src/utf.
# Example for local development:
# THIRSTY_LANG_PATH=T:\00-Active\thirsty_lang_exploration_0754
#
# Optional TARL policy for the startup protocol. If unset, only INIT_PROTOCOL
# is allowed by the local default startup policy.
# THIRSTY_WATERFALL_INIT_POLICY=policy waterfall_init:\n  when protocol == "INIT_PROTOCOL" => ALLOW

# Encryption keys (base64 encoded)
# MASTER_ENCRYPTION_KEY=
# DATA_ENCRYPTION_KEY=

# VPN Configuration
# VPN_SHARED_SECRET=
# VPN_SERVER_CERT=
# VPN_CLIENT_KEY=

# Hardware Security Module (HSM) Configuration
# HSM_PIN=
# HSM_LABEL=
# HSM_KEY_ID=

# Third-party service credentials
# OAUTH_CLIENT_ID=
# OAUTH_CLIENT_SECRET=
# SMTP_PASSWORD=

# -----------------------------------------------------------------------------
# CI/CD Integration
# -----------------------------------------------------------------------------
# In CI/CD pipelines (GitHub Actions, GitLab CI, etc.):
# 1. Store secrets in the platform's secret management system
# 2. Inject as environment variables during build/test
# 3. Use dummy/mock values for tests when possible
# 4. Never log secret values in CI output
# 
# Example GitHub Actions:
#   - name: Run tests
#     env:
#       DEMO_MASTER_ENCRYPTION_KEY: ${{ secrets.DEMO_MASTER_ENCRYPTION_KEY }}
#     run: python -m unittest discover tests
# -----------------------------------------------------------------------------