# Freedom Fitness Janakpur — real environment configuration.
# KEEP THIS FILE PRIVATE. Never commit it to git or share it.
# (This project now ships a .gitignore that excludes this file —
# see the Production Readiness Audit report for why that matters.)

# Server
PORT=4000
NODE_ENV=development
PUBLIC_API_URL=http://localhost:4000
PUBLIC_SITE_URL=http://localhost:5500
CORS_ORIGIN=

# Auth
# SECURITY NOTE (2026-08-03): the JWT_SECRET and ADMIN_PASSWORD below were
# freshly rotated during a production-readiness audit, because the
# previous values had been exposed in a shared chat/file transfer and had
# to be treated as compromised. Every existing admin session was
# invalidated by this rotation, which is expected and safe.
# IMPORTANT: rotate these AGAIN yourself (or generate your own) before a
# real production launch — do not reuse values that have ever left your
# own machine. Free generators: randomkeygen.com ("CodeIgniter Encryption
# Key" style) for JWT_SECRET, any password manager for ADMIN_PASSWORD.
JWT_SECRET=ad0f6b7e3e66caafa3a3b0f25df2a5947d2814290d38a3fa7683728bd21f6e88d8ac54027e847de61d30167abf7d484404fc3156ffd089f1640c50e28e561171
JWT_EXPIRES_IN=12h
ADMIN_EMAIL=freedomfitness517@gmail.com
# Bootstrap password for the very first login only. Log in once with this,
# then immediately change it from Admin -> Security Center. This value is
# only ever read the FIRST time the database is created; changing it here
# later has no effect on an admin account that already exists — if you've
# already logged in once, change your password from inside the admin
# panel instead of editing this line.
ADMIN_PASSWORD=e^GFcC%uQsfdgZPU%hf3
RECOVERY_EMAIL=freedomfitness517@gmail.com

DB_BACKUP_ENABLED=true
DB_BACKUP_HOUR=3
DB_BACKUP_RETENTION=30

# Email (Gmail SMTP) — powers Forgot Password + security notifications
# SECURITY NOTE (2026-08-03): the SMTP_PASS that was previously here was a
# real Gmail App Password and has been REMOVED because it was exposed in a
# shared chat/file transfer. Treat that old app password as compromised —
# revoke it now at https://myaccount.google.com/apppasswords (for
# freedomfitness517@gmail.com) even though it's no longer in this file.
# Generate a NEW App Password there and paste it below to re-enable real
# email delivery. Until you do, password-reset links are logged to the
# server console instead of emailed — the feature still works for testing.
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=freedomfitness517@gmail.com
SMTP_PASS=
EMAIL_FROM=freedomfitness517@gmail.com
EMAIL_FROM_NAME=Freedom
