.env.example

# Application Configuration
NODE_ENV=development
PORT=3000

# InfluxDB Configuration - Client-Side (VITE_ prefix)
# These are embedded in the client bundle and are PUBLIC
VITE_INFLUXDB_ORG=idea-helsinki
VITE_INFLUXDB_BUCKET=idea-validation-bucket

# InfluxDB Configuration - Server-Side (Vite Dev Proxy)
# These are used by the Vite dev proxy to connect to InfluxDB
# NOT embedded in client bundle, kept server-side during development
VITE_INFLUXDB_HOST=idea-helsinki-influxdb.dataportal.fi
INFLUXDB_TOKEN=your-development-influxdb-token-here

# NGINX Configuration (Production Only)
# These are used by NGINX in production to proxy InfluxDB requests
# Set via Kubernetes ConfigMap/Secrets, not needed for local development
# INFLUXDB_URL=http://idea-helsinki-influxdb-helm-webapp.idea-helsinki.svc.cluster.local:8086
# INFLUXDB_HOST=idea-helsinki-influxdb-helm-webapp.idea-helsinki.svc.cluster.local:8086
# INFLUXDB_TOKEN=<from-secret-manager>

# Feature Flags (GoFeatureFlag relay proxy)
# The app automatically detects GOFF availability via health check.
# In local dev, falls back to InMemoryProvider with defaults (all features disabled).
# To test with GOFF locally:
#   kubectl port-forward -n feature-flags svc/gofeatureflag 1031:1031
# The Vite dev proxy forwards /feature-flags → localhost:1031

# Google OAuth2 Configuration
# Create a Web Application OAuth 2.0 client in GCP Console
# Add dashboard.helsinki.trafficflowdataspace.eu as an authorized JavaScript origin
VITE_GOOGLE_CLIENT_ID=your-google-oauth-client-id.apps.googleusercontent.com

# ===================================
# IMPORTANT: Understanding VITE_ Prefix
# ===================================
# Vite environment variables follow this pattern:
# - VITE_* variables: Embedded into client-side bundle at BUILD TIME
#   These become PUBLIC and visible in browser JavaScript
#   Only use for non-sensitive configuration (org names, bucket names, etc.)
#
# - Non-prefixed variables: Server-side only, never exposed to client
#   (e.g., NODE_ENV, PORT, INFLUXDB_TOKEN, SENTRY_AUTH_TOKEN)
#
# ✅ SECURITY IMPROVEMENT:
# - InfluxDB requests now go through a proxy (/influxdb-api)
# - Token is added server-side by Vite proxy (dev) or NGINX (prod)
# - Client code never has direct access to the InfluxDB token
# - For production: Token stored in Google Secret Manager and injected via Kubernetes