.env.example

# Example environment variables
# Copy this to .env.development.local for local overrides/secrets
#
# All matching .env files are loaded by both Next.js and Wrangler, and values are
# merged. For each variable, the value from the most specific file is used, with
# the following precedence (most to least specific):
#   .env.<environment>.local (most specific) - gitignored, for your local secrets. E.g. .env.development.local
#   .env.local                               - gitignored, for local overrides for all environments
#   .env.<environment>                       - committed, for shared defaults. E.g. .env.development
#   .env                                     - committed, for global defaults

# Only .env.local and .env.*.local files should contain secrets.
# All other .env files are committed to share configuration across contributors.

# Public variables (exposed to browser) must be prefixed with NEXT_PUBLIC_
# Example: NEXT_PUBLIC_API_URL=https://api.example.com

# Private variables (server-side only) have no prefix
# Example: DATABASE_URL=postgresql://localhost/mydb
# Example: API_SECRET_KEY=your-secret-here

# --------------------------------------
# Project-specific local development vars
# --------------------------------------

# Canonical site URL used by metadata and analytics origin checks.
# Use localhost in local development to avoid 403 responses from
# /api/analytics/blog-read due to host mismatch.
NEXT_PUBLIC_SITE_URL=http://localhost:3000

# Secret used to HMAC-hash client IPs for blog analytics (GDPR-safe).
# Required by app/api/analytics/blog-read/route.ts.
# You can generate this with: `openssl rand -hex 32`
ANALYTICS_HASH_SECRET=replace-with-random-secret