# ═══════════════════════════════════════════════════════════════
#  SSH Launcher — Environment Variables
#  Copy to .env.local for local dev, or paste into Vercel dashboard
#  (Settings → Environment Variables → Import .env)
# ═══════════════════════════════════════════════════════════════

# ── GitHub OAuth ─────────────────────────────────────────────
# Create at https://github.com/settings/developers → New OAuth App
# Homepage URL:    https://your-domain.vercel.app
# Callback URL:    https://your-domain.vercel.app/api/auth/callback/github
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# ── NextAuth ─────────────────────────────────────────────────
# Generate secret:  openssl rand -base64 32
NEXTAUTH_SECRET=
# Required only when self-hosting (Vercel sets this automatically)
# NEXTAUTH_URL=https://your-domain.vercel.app

# ── Upstash Redis ─────────────────────────────────────────────
# Stores per-user Cloudflare credentials (multi-user)
# Create a free database at https://console.upstash.com
# Copy the REST API URL and Token from the database dashboard
UPSTASH_REDIS_URL=
UPSTASH_REDIS_TOKEN=

# ── Cloudflare API (optional — can set per-user via /settings) ─
# If set here, all users share these credentials (single-user mode)
# Required Token permissions:
#   Account → Cloudflare Tunnel: Edit
#   Account → Access: Apps and Policies: Edit
#   Zone    → DNS: Edit
#   Zone    → Zone: Read
CLOUDFLARE_ACCOUNT_ID=
CLOUDFLARE_API_TOKEN=

# ── Cloudflare Access Service Token (optional) ───────────────
# Used to fetch server metrics through Access-protected tunnels
# Create in Zero Trust → Access → Service Auth → Service Tokens
CF_SERVICE_CLIENT_ID=
CF_SERVICE_CLIENT_SECRET=