CodeForge/.env.example at main · SamRepository25/CodeForge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# ==================================================
# CodeForge Environment Variables
# Copy this file to .env and replace the placeholder
# values with your own Supabase credentials.
# ==================================================

# Supabase Project ID
SUPABASE_PROJECT_ID=your_supabase_project_id

# Supabase URL
SUPABASE_URL=https://your-project-id.supabase.co

# Public URL for Vite
VITE_SUPABASE_URL=https://your-project-id.supabase.co

# Public API Key (safe for frontend)
SUPABASE_PUBLISHABLE_KEY=sb_publishable_your_publishable_key

# Public API Key for Vite
VITE_SUPABASE_PUBLISHABLE_KEY=sb_publishable_your_publishable_key

# Server-only Service Role Key
# Never expose this key publicly.
SUPABASE_SERVICE_ROLE_KEY=sb_secret_your_service_role_key

# ==================================================
# Contact form (server-only unless noted)
# ==================================================

# Resend API key — used to send you a notification email when a
# contact form message is received. If unset, the notification is
# skipped (the message still saves to the database normally).
RESEND_API_KEY=re_your_resend_api_key

# The email address that should receive contact form notifications.
CONTACT_NOTIFY_EMAIL=you@example.com

# The "from" address the notification email is sent as. Must be a
# domain you've verified with Resend, or their shared test domain.
CONTACT_FROM_EMAIL=CodeForge <onboarding@resend.dev>

# Cloudflare Turnstile secret key — used server-side to verify the
# spam-check token from the contact form. If unset, verification is
# skipped outside production but fails closed (blocks all
# submissions) when NODE_ENV=production.
TURNSTILE_SECRET_KEY=your_turnstile_secret_key
# Comma-separated production hostnames returned by Turnstile Siteverify.
TURNSTILE_HOSTNAMES=codeforgedev.vercel.app

# Cloudflare Turnstile site key — public, used client-side to render
# the widget. Must be set together with TURNSTILE_SECRET_KEY above,
# or the contact form will reject every submission in production.
VITE_TURNSTILE_SITE_KEY=your_turnstile_site_key

# Salt used when hashing visitor IP addresses for contact form rate
# limiting. Optional — falls back to a built-in default if unset,
# but setting your own value is recommended.
CONTACT_IP_HASH_SALT=choose_a_random_string


# Server-only random salt used to hash client IPs for login lockout keys.
LOGIN_IP_HASH_SALT=replace_with_a_long_random_secret