.env.example

# ── Backing services ──────────────────────────────────────────────
# Provisioned automatically by the Vercel Deploy Button (Neon, Upstash, Blob).

DATABASE_URL=postgresql://user:pass@host/db?sslmode=require
DATABASE_URL_UNPOOLED=postgresql://user:pass@host/db?sslmode=require

KV_REST_API_URL=https://example.upstash.io
KV_REST_API_TOKEN=

# Vercel Blob (snapshot agent binary)
BLOB_READ_WRITE_TOKEN=

# ── Secrets ───────────────────────────────────────────────────────

# Hetzner Cloud API token (Read & Write) — all provisioning runs against
# your Hetzner project and is billed to you.
HETZNER_API_TOKEN=

# Dashboard sign-in password. Email is optional and defaults to
# admin@ghost.local.
AUTH_PASSWORD=
# AUTH_EMAIL=

# Signs the session cookie, agent bootstrap JWTs, and snapshot download
# tokens. Generate with: openssl rand -hex 32. Rotating it signs out all
# sessions and invalidates in-flight enrollment tokens.
GHOST_SECRET=

# ── Vercel ────────────────────────────────────────────────────────
# On Vercel, SEO_URL and API_URL are derived from VERCEL_PROJECT_PRODUCTION_URL
# and VERCEL_BRANCH_URL automatically. Locally, both fall back to
# http://localhost:3000.
#
# VERCEL_AUTOMATION_BYPASS_SECRET is required on Vercel preview deployments so
# Hetzner agents can punch through deployment protection on callbacks. It's not
# needed locally or in production.
VERCEL_AUTOMATION_BYPASS_SECRET=