# MessageWeave production bootstrap (C-REDIS-ONLY-STATE)
#
# The process requires only these two variables. CONFIG_ENCRYPTION_KEY is the SPA
# admin credential and the one-shot bootstrap trust root; the Redis ACL password
# in REDIS_URL only gates the database connection (see `src/main.rs`, `redis_value`).
# Never commit or log a real URL/password/key.
REDIS_URL=redis://:REPLACE_WITH_REDIS_ACL_PASSWORD@redis.example.com:6379/0
# Required 32-byte random hex key (64 hex characters). Never store in Redis or logs.
CONFIG_ENCRYPTION_KEY=REPLACE_WITH_64_HEX_CHAR_RANDOM_KEY

# PORT is an optional platform override (default: 8080). There is no RUN_MODE: the
# legacy env parser was removed, and webhook plus reconcile traffic share one router.
# BACKEND_ID is an optional per-instance observability label echoed as `backend` in
# /api/status, so a probe through the load balancer can tell which origin answered
# (the baked build `version` is identical across instances of one image). Falls back
# to HOSTNAME. Not a secret, not a connection setting, never persisted.
BACKEND_ID=
# Business secrets (Telegram/JMAP/LLM/auth) must be supplied once via HTTPS /api/bootstrap;
# they are then persisted in Redis and are never echoed by the API.