.env.example

# Turso / libSQL — the waitlist database
# Create a DB at https://turso.tech then: turso db show <name> --url  /  turso db tokens create <name>
TURSO_DATABASE_URL=libsql://your-db.turso.io
TURSO_AUTH_TOKEN=your-token

# Login with CoinPayPortal (OAuth). Register a client at
# https://coinpayportal.com/dashboard/oauth/new with redirect_uri =
# <APP_BASE_URL>/auth/coinpay/callback and scopes "openid email profile".
COINPAY_ISSUER=https://coinpayportal.com
COINPAY_CLIENT_ID=cp_xxx
COINPAY_CLIENT_SECRET=cps_xxx
APP_BASE_URL=http://localhost:8080
# OAUTH_REDIRECT_URI=            # pins one redirect_uri; overrides the per-host logic below
# Extra hostnames this app answers on that may be used as an OAuth redirect_uri
# (comma-separated). APP_BASE_URL's own host is always allowed. Each one must
# ALSO be registered as a redirect_uri on the CoinPay OAuth client, and a host
# that is not listed here silently falls back to APP_BASE_URL -- the Host header
# is attacker-controlled, so it is never reflected into a redirect_uri unchecked.
# OAUTH_ALLOWED_HOSTS=pit.moshcode.sh
SESSION_SECRET=change-me-to-a-long-random-string

# CoinPayPortal PAYMENTS (distinct from OAuth login above) — the $1 account
# setup fee. Create a payments-scoped API key on your CoinPayPortal business
# (scope payments:create) and set a webhook there pointing at
# <APP_BASE_URL>/api/coinpay/webhook with the secret below. When COINPAY_API_KEY
# is unset, signup auto-activates without charging (dev).
COINPAY_API_KEY=cp_live_xxx
COINPAY_BUSINESS_ID=            # UUID; optional if the API key is business-scoped
COINPAY_WEBHOOK_SECRET=        # verifies the X-CoinPay-Signature webhook
COINPAY_PAY_CHAIN=USDC_POL     # blockchain the $1 is charged on
SETUP_FEE_USD=1.00

# GitHub webhook — emails NOTIFY_EMAIL when a PR/issue is closed. Add a webhook
# on the repo (Settings → Webhooks) → <APP_BASE_URL>/api/webhooks/github,
# content-type application/json, secret = GITHUB_WEBHOOK_SECRET, events =
# Issues + Pull requests. Verified via X-Hub-Signature-256.
GITHUB_WEBHOOK_SECRET=ghwh_xxx
NOTIFY_EMAIL=moshcoder@gmail.com
# Optional: MOSHCODE_WEBHOOK_SECRET verifies /api/webhooks/moshcode.
MOSHCODE_WEBHOOK_SECRET=whsec_xxx

# Resend — waitlist double opt-in confirmation emails.
# Get a key at https://resend.com/api-keys and verify your sending domain.
# When RESEND_API_KEY is unset, signups are auto-confirmed (no email sent).
RESEND_API_KEY=re_xxx
RESEND_FROM=moshcoding <noreply@moshcoding.com>

# Optional
# PORT=8080

# OpenAI — AI hero image for ?style=<genre> tenant pages (gpt-image-*).
OPENAI_API_KEY=sk-xxx
OPENAI_IMAGE_MODEL=gpt-image-2
# Where generated images are cached AND uploaded reels (dashboard → Videos) are
# stored. Mount a Railway volume here to persist across deploys (otherwise
# generated images regenerate and uploaded videos are lost after each deploy).
DATA_DIR=.data
# Max size per uploaded reel, in bytes (default 100 MB).
# MEDIA_MAX_BYTES=104857600

# Railway API token — powers the dashboard "Custom domain" tab (self-serve): a
# user parks their claimed domain here and gets the DNS records to set, with a
# Verify button. Use a PROJECT token (Railway → project → Settings → Tokens) —
# it authenticates with the Project-Access-Token header; an account/team token
# (Authorization: Bearer) also works. Project/service/env default to this
# deployment; override if needed.
RAILWAY_API_TOKEN=
# RAILWAY_PROJECT_ID=
# RAILWAY_SERVICE_ID=
# RAILWAY_ENVIRONMENT_ID=

# ---------------------------------------------------------------------------
# Moshpit DNS resolver (`bun run dns`, docs/moshpit-dns.md)
#
# Runs as its own process, not part of the Next.js app: it needs UDP/53, which
# a web host does not give you. None of this is required — with an empty
# environment it resolves Moshpit names from the public registry and forwards
# everything else to 8.8.8.8 and 1.1.1.1.
# ---------------------------------------------------------------------------
# Port 53 is the point of the thing, but binding it needs privileges:
#   sudo setcap cap_net_bind_service=+ep $(which bun)
# The default (5354) runs unprivileged for development.
# MOSHPIT_DNS_PORT=53
# MOSHPIT_DNS_ADDRESS=0.0.0.0
# DoH + /health. Set to 0 to serve plain DNS only.
# MOSHPIT_DNS_HTTP_PORT=8053

# Where clearnet names go. Tried in order, staggered rather than raced.
# MOSHPIT_DNS_UPSTREAMS=8.8.8.8,1.1.1.1

# 'clearnet' (default): clearnet owns any name it can answer, Moshpit fills the
# gaps. 'moshpit': a registered Moshpit name beats the clearnet domain of the
# same name. Anything under a TLD clearnet has never heard of resolves either way.
# MOSHPIT_RESOLVE_MODE=clearnet

# The registry this resolver reads. Point it at your own to run a private pit.
# MOSHPIT_REGISTRY_BASE=https://pit.moshcode.sh

# Where Moshpit names point. Resolved through the upstreams and cached, so the
# gateway can move without redeploying resolvers; pin it to skip the lookup.
# MOSHPIT_GATEWAY_HOST=pit.moshcode.sh
# MOSHPIT_GATEWAY_A=203.0.113.7
# MOSHPIT_GATEWAY_AAAA=

# TTL on synthesized answers. Short on purpose: names change hands.
# MOSHPIT_DNS_TTL=60

# Per-client rate limit. A public resolver is a reflection amplifier without
# one. 0 disables it — only sane behind an allowlist or on a private network.
# MOSHPIT_DNS_QPS=50
# MOSHPIT_DNS_BURST=100

# 'queries' logs one line per query (no client addresses are stored anywhere),
# 'off' silences startup lines too.
# MOSHPIT_DNS_LOG=

# Catch-all: resolve names nobody has claimed, under endings the legacy root
# does not have, so `mosh.whatever` lands on the pit instead of an error page.
# Never fires for a real TLD (`asdkjh.com` stays NXDOMAIN) — that boundary is
# checked against the root, not assumed. Off by default: it answers for names
# the registry never granted, which is a product decision.
# MOSHPIT_DNS_CATCHALL=1