.env.example

# Database
DATABASE_URL=postgres://db_user:db_password@127.0.0.1:5432/blog_db

# Admin account
ADMIN_USER=change_me
# Generate with: node -e "const b=require('bcryptjs');console.log(b.hashSync('ChangeMe!',12))"
# IMPORTANT: escape each "$" as "\$" to avoid dotenv expansion corruption.
ADMIN_PASSWORD_HASH=\$2b\$12\$change_me_bcrypt_hash

# Auth/session
JWT_SECRET=replace_with_strong_random_secret
COOKIE_NAME=__Host-blog_session
COOKIE_SECURE=true

# Public origin used for same-origin checks
APP_ORIGIN=https://example.com

# API base (optional, empty means same-origin /api)
NEXT_PUBLIC_API_BASE=

# HTTPS enforcement
FORCE_HTTPS=true

# SSL update API paths
SSL_KEY_PATH=/path/to/site.key
SSL_CERT_PATH=/path/to/site.pem