# occupymedia.cc deployment secrets — copy to .env on the box, fill every :? value.
# NEVER commit the filled .env.

# --- Cloudflare (already provisioned; tunnel + DNS + R2 buckets exist) ---
CLOUDFLARE_ACCOUNT_ID=e50adafec3c6aee02a328f28b967f699
CLOUDFLARE_TUNNEL_TOKEN=<fromkeepass-or-ask-coordinator>   # occupymedia tunnel e5695d8b-…

# --- R2 (S3 API token: dashboard → R2 → Manage API Tokens → Object Read & Write,
#     scoped to the four occupymedia-* buckets) ---
R2_ACCESS_KEY=<paste R2 Access Key ID>
R2_SECRET_KEY=<paste R2 Secret Access Key>

# --- Database ---
POSTGRES_PASSWORD=<generate: openssl rand -hex 24>
# Runtime-only role provisioned by migration 003. Set its production password
# with owner access; never reuse POSTGRES_PASSWORD or the development default.
DATABASE_URL=postgres://sp_app:<runtime-password>@postgres:5432/occupymedia
SCHEDULER_DATABASE_URL=postgres://sp_app:<runtime-password>@postgres:5432/occupymedia
# SUPER_DATABASE_URL is passed only to the offline migration CLI, never services.
PEERTUBE_DB_PASSWORD=<generate: openssl rand -hex 24>   # also paste into peertube.env
SESSION_SECRET=<generate: openssl rand -base64 32>

# --- Client-side envelope encryption for the media archive ---
# One random 32-byte base64 key. It wraps EVERY stored blob (DEK/KEK envelope).
# Lose it = archive unreadable. Rotate = full re-encrypt. Store in the password manager.
S3_KEK=<generate ONCE: openssl rand -base64 32>
SUPERPOSTER_KEK=<same bytes as S3_KEK, base64>