NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key
NEXT_PUBLIC_APP_URL=https://your-domain.com
CRON_SECRET=generate-a-random-secret

# Self-hosted (Docker) flag: disables application-side MFA enforcement.
NEXT_PUBLIC_SELF_HOSTED=true

# Session timeouts are also disabled by default for self-hosted deployments.
# Uncomment to opt into hosted-style banking-app limits (milliseconds).
# Automatic logout is additionally opt-in per user (Settings > Security);
# set NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=true to enforce it for everyone.
# NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_MS=1800000
# NEXT_PUBLIC_SESSION_ABSOLUTE_TIMEOUT_MS=43200000
# NEXT_PUBLIC_SESSION_WARNING_MS=120000
# NEXT_PUBLIC_SESSION_TIMEOUT_FORCE_ALL=false
# Optional dedicated HMAC secret; otherwise SUPABASE_SERVICE_ROLE_KEY is used.
# SESSION_TIMEOUT_SECRET=

# Optional Cloudflare Turnstile site key for Supabase Auth bot protection.
# The matching secret is configured in GoTrue/Supabase Auth, never here.
# Enable provider-side enforcement only after this public key is deployed.
# NEXT_PUBLIC_TURNSTILE_SITE_KEY=

# Set to true when public signup is turned off in your GoTrue/Supabase auth
# config (GOTRUE_DISABLE_SIGNUP / "Allow new users to sign up" off). GoTrue
# offers no clean server-side read of that setting, so this flag mirrors it.
# When true, inviting a teammate who has no account provisions the account
# server-side via the auth admin invite API (GoTrue must have SMTP configured
# to deliver that mail) instead of relying on public /register, which GoTrue
# would reject with "Signups not allowed".
# The GoTrue redirect URI allow-list (URI Allow List / GOTRUE_URI_ALLOW_LIST)
# must include /invite/* or the invite email's redirect silently falls back
# to SITE_URL.
# AUTH_SIGNUPS_DISABLED=false

# Optional: WebSocket origin allowed for Supabase Realtime in the CSP.
# Defaults to NEXT_PUBLIC_SUPABASE_URL with https:// replaced by wss://
# (http:// by ws://). Set only if Realtime is served from another origin.
# NEXT_PUBLIC_SUPABASE_WS_URL=wss://your-project.supabase.co

# Optional: connector subscription for this self-hosted instance (bank sync,
# Skatteverket API, company lookup, migration run on services Accounted
# operates). Key issued by Accounted; the hourly connector sync writes the
# capability grants. See docs/SELF-HOSTING.md "Connector subscription".
# GNUBOK_CONNECTOR_KEY=
# GNUBOK_CONNECT_URL=https://app.gnubok.se
# Optional: AI features (document extraction, in-app assistant). The image
# includes the extraction extensions; set ONE backend. See
# docs/SELF-HOSTING.md "AI Features" for the full list of model overrides.
# 1. Claude via AWS Bedrock (inference stays inside the EU through the eu.
#    cross-region inference profile; AWS_REGION is the API endpoint, not a pin):
# AWS_ACCESS_KEY_ID=
# AWS_SECRET_ACCESS_KEY=
# AWS_REGION=eu-north-1
# 2. Claude via the direct Anthropic API:
# ANTHROPIC_API_KEY=
# 3. Any OpenAI-compatible endpoint (e.g. a Swedish inference provider; see
#    docs/SOVEREIGN.md). A model id is required. Extraction, the assistant's
#    question-and-answer and categorization run here; only the specialized
#    Anthropic-only conversational flows return 503 (see docs/SELF-HOSTING.md,
#    What runs on any model).
# AI_BASE_URL=https://api.example.se/v1
# AI_API_KEY=
# AI_MODEL=
# AI_EXTRACTION_MODEL=       # a vision model, if AI_MODEL is not one
# AI_VISION=true             # false for a text-only model
# AI_PDF_MODE=auto           # auto | native | rasterize (the image ships pdftoppm)

# Optional: outbound email (invoices, reminders). Pick one provider.
# 1. Resend (what hosted runs):
# RESEND_API_KEY=
# RESEND_FROM_EMAIL=
# 2. Your own SMTP relay (Swedish mail provider, M365/Workspace relay, Postfix):
# EMAIL_PROVIDER=smtp
# SMTP_HOST=
# SMTP_PORT=587
# SMTP_SECURE=false          # true = implicit TLS on 465, false = STARTTLS required (set SMTP_REQUIRE_TLS=false only for a plaintext LAN relay)
# SMTP_USER=
# SMTP_PASS=
# SMTP_FROM_EMAIL=
# SMTP_REQUIRE_TLS=true      # false only for a plaintext relay on a trusted LAN