.env.example

# =============================================================================
# Screen Recorder - Self-Hosted [BAUER GROUP Edition]
# =============================================================================
# Documentation: https://cap.so/docs/self-hosting
# Repository: https://github.com/CapSoftware/Cap
#
# This file contains all configuration options for Cap self-hosted deployment.
# Copy this file to .env and adjust values as needed.
#
# IMPORTANT: Run ./scripts/generate-secrets.sh to generate secure passwords!
# =============================================================================

# -----------------------------------------------------------------------------
# STACK IDENTIFICATION
# -----------------------------------------------------------------------------

# Unique name for this deployment (used in container names, volumes, networks)
# Use lowercase, alphanumeric with underscores only
STACK_NAME=screenrecorder_app_bauer-group_com

# Timezone for all services
TIME_ZONE=Etc/UTC

# -----------------------------------------------------------------------------
# VERSION CONFIGURATION
# -----------------------------------------------------------------------------

# Cap Web application version (Git tag from https://github.com/CapSoftware/Cap)
# Available tags: https://github.com/CapSoftware/Cap/tags
# Format: cap-vX.Y.Z (e.g., cap-v0.4.0, cap-v0.3.0)
CAP_VERSION=cap-v0.4.82

# MySQL version (8.4 LTS recommended)
MYSQL_VERSION=8.4

# MinIO version
MINIO_VERSION=latest

# -----------------------------------------------------------------------------
# NETWORK CONFIGURATION
# -----------------------------------------------------------------------------

# -- Development Mode --
# Direct port exposure (no reverse proxy)
EXPOSED_APP_PORT=3000
EXPOSED_MYSQL_PORT=3306
EXPOSED_MINIO_API_PORT=9000
EXPOSED_MINIO_CONSOLE_PORT=9001

# -- Production Mode (Traefik) --
# DNS must resolve to these hostnames
SERVICE_HOSTNAME=screenrecorder.app.bauer-group.com
S3_HOSTNAME=assets.screenrecorder.app.bauer-group.com
S3_CONSOLE_HOSTNAME=assets-console.screenrecorder.app.bauer-group.com

# External Traefik network name
PROXY_NETWORK=EDGEPROXY

# -----------------------------------------------------------------------------
# CAP APPLICATION SETTINGS
# -----------------------------------------------------------------------------

# Public URL of the Cap server (REQUIRED)
# This is used for generating share links and OAuth callbacks
# Development: http://localhost:3000
# Production: https://screenrecorder.app.bauer-group.com
WEB_URL=https://screenrecorder.app.bauer-group.com

# Node environment
NODE_ENV=production

# Default visibility for new videos
# true = public by default, false = private by default
CAP_VIDEOS_DEFAULT_PUBLIC=false

# Restrict signups to specific email domains (comma-separated)
# Leave empty to allow all domains
# Example: bauer-group.com,example.com
CAP_ALLOWED_SIGNUP_DOMAINS=

# Client download URL (for /download redirect)
# Default: https://cap.so/download (official Cap download page)
# Self-hosted: Point to your own S3 bucket with client installers including index.html
# Example: https://assets.screenrecorder.app.bauer-group.com/downloads/index.html
# Setup: Run scripts/setup-client-bucket.py and scripts/sync-clients.py
CAP_CLIENT_DOWNLOAD_URL=https://cap.so/download

# -----------------------------------------------------------------------------
# AUTHENTICATION SECRETS (REQUIRED)
# -----------------------------------------------------------------------------
# Run ./scripts/generate-secrets.sh to generate these values!

# NextAuth secret (REQUIRED)
# Used for encrypting session tokens
# Note: generate-secrets.sh creates shell-safe alphanumeric secrets
NEXTAUTH_SECRET=

# Database encryption key (32 byte hex string)
# Used for encrypting sensitive data like AWS access keys stored in database
# Note: Hex format is inherently shell-safe (0-9, a-f only)
DATABASE_ENCRYPTION_KEY=

# -----------------------------------------------------------------------------
# DATABASE CONFIGURATION (MySQL)
# -----------------------------------------------------------------------------
# Note: Database name and user are static in compose files (cap/cap)

# Database password (REQUIRED)
# Note: generate-secrets.sh creates shell-safe alphanumeric passwords
DATABASE_PASSWORD=

# Database connection pool size
DATABASE_POOL_SIZE=20

# -----------------------------------------------------------------------------
# S3 STORAGE CONFIGURATION (MinIO)
# -----------------------------------------------------------------------------
# Note: Bucket name (media) and service user (cap) are static in compose files.

# S3 region (used for bucket creation and API requests)
# Default: global (works for most S3-compatible services)
# AWS: us-east-1, eu-central-1, etc.
AWS_S3_REGION=global

# MinIO root credentials (admin access)
# Note: generate-secrets.sh creates shell-safe alphanumeric passwords
MINIO_ROOT_USER=admin
MINIO_ROOT_PASSWORD=

# S3 service account secret key (for Cap application)
# Note: generate-secrets.sh creates shell-safe alphanumeric keys
CAP_AWS_SECRET_KEY=

# -----------------------------------------------------------------------------
# MEDIA SERVER CONFIGURATION
# -----------------------------------------------------------------------------

# Shared secret between cap-web and media-server for webhook authentication
# IMPORTANT: Change from default! Run: openssl rand -hex 32
MEDIA_SERVER_WEBHOOK_SECRET=

# -----------------------------------------------------------------------------
# EMAIL CONFIGURATION (Optional)
# -----------------------------------------------------------------------------
# If not configured, login links will be written to server logs.
#
# Priority: SMTP > Resend > Console Log
# Configure either SMTP or Resend, not both.

# -- SMTP Settings (Recommended for self-hosted) --
# Standard SMTP server configuration
SMTP_HOST=
SMTP_PORT=587
SMTP_TLS=false
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=no-reply@message.bauer-group.com
SMTP_FROM_NAME=Screen Recorder [BAUER GROUP]

# -- Resend.com (Cloud alternative) --
# Only used if SMTP_HOST is not set
# Sign up at https://resend.com and create an API key
RESEND_API_KEY=
# Domain for sending emails (must be verified in Resend)
RESEND_FROM_DOMAIN=

# -----------------------------------------------------------------------------
# OAUTH PROVIDERS (Optional)
# -----------------------------------------------------------------------------

# -- Microsoft Entra ID (Azure AD) --
# Portal: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
#
# Setup:
#   1. Click "New registration"
#   2. Name: "Screen Recorder" (or your preferred name)
#   3. Supported account types:
#      - Single tenant: "Accounts in this organizational directory only"
#      - Multi-tenant: "Accounts in any organizational directory"
#   4. Redirect URI (Web): https://${SERVICE_HOSTNAME}/api/auth/callback/azure-ad
#   5. Click "Register"
#
# After registration:
#   6. Overview > Copy "Application (client) ID" → AZURE_AD_CLIENT_ID
#   7. Overview > Copy "Directory (tenant) ID" → AZURE_AD_TENANT_ID (single-tenant only)
#   8. Certificates & secrets > New client secret > Copy "Value" → AZURE_AD_CLIENT_SECRET
#
# API Permissions (already granted by default):
#   - openid, email, profile, User.Read (delegated)
#
# Tenant configuration:
#   - Single-tenant: Set AZURE_AD_TENANT_ID to your Directory ID
#   - Multi-tenant: Leave AZURE_AD_TENANT_ID empty (uses "common")
#
AZURE_AD_TENANT_ID=
AZURE_AD_CLIENT_ID=
AZURE_AD_CLIENT_SECRET=

# -- Google OAuth --
# Setup: https://console.cloud.google.com/apis/credentials
# Redirect URI: https://${SERVICE_HOSTNAME}/api/auth/callback/google
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# -- WorkOS (Enterprise SSO) --
# Sign up at https://workos.com
WORKOS_CLIENT_ID=
WORKOS_API_KEY=

# -----------------------------------------------------------------------------
# AI FEATURES (Optional)
# -----------------------------------------------------------------------------

# Audio transcription (Deepgram)
# Sign up at https://deepgram.com
DEEPGRAM_API_KEY=

# AI summaries - use ONE of the following:
# OpenAI: https://platform.openai.com/api-keys
OPENAI_API_KEY=

# Groq (faster, cheaper alternative): https://console.groq.com
GROQ_API_KEY=

# -----------------------------------------------------------------------------
# PAYMENTS (Optional)
# -----------------------------------------------------------------------------

# Stripe integration
# Get keys at https://dashboard.stripe.com/apikeys
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=

# -----------------------------------------------------------------------------
# INTEGRATIONS (Optional)
# -----------------------------------------------------------------------------

# Discord webhooks for notifications
DISCORD_FEEDBACK_WEBHOOK_URL=
DISCORD_LOGS_WEBHOOK_URL=

# Analytics
TINYBIRD_HOST=
TINYBIRD_TOKEN=

# URL shortener
DUB_API_KEY=

# Customer communication
INTERCOM_SECRET=

# PostHog product analytics
POSTHOG_PERSONAL_API_KEY=

# -----------------------------------------------------------------------------
# CLOUDFRONT CDN (Optional)
# -----------------------------------------------------------------------------
# For production deployments with high traffic.
#
# IMPORTANT: Keep these variables commented out if not using CloudFront!
# Setting empty values will cause "DECODER routines::unsupported" errors.
# Only uncomment and configure if you have a valid CloudFront distribution.
#
# CAP_CLOUDFRONT_DISTRIBUTION_ID=your-distribution-id
# CLOUDFRONT_KEYPAIR_ID=your-keypair-id
# CLOUDFRONT_KEYPAIR_PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----

# -----------------------------------------------------------------------------
# ACCESS POINTS
# -----------------------------------------------------------------------------
#
# Development:
#   App:           http://localhost:3000
#   MinIO API:     http://localhost:9000
#   MinIO Console: http://localhost:9001
#
# Production:
#   App:                  https://screenrecorder.app.bauer-group.com
#   S3 API:               https://assets.screenrecorder.app.bauer-group.com
#   MinIO Console:        https://assets-console.screenrecorder.app.bauer-group.com
#   Client Downloads URL: https://assets.screenrecorder.app.bauer-group.com/downloads/index.html
#