# Environment variables

## Files

| File | Purpose |
|------|---------|
| `.env` | Your real secrets on your machine. **Git ignores it.** |
| `.env.example` | Safe template with no secrets — commit this; copy when setting up a new machine. |

## First-time setup

1. Copy the template (if `.env` is missing):

   ```bash
   cp .env.example .env
   ```

2. **Aiven MySQL** — Console → your service → **Connection information** (MySQL tab):

   | Aiven field | Put in `.env` |
   |-------------|----------------|
   | Host | `DB_HOST` |
   | Port | `DB_PORT` |
   | User | `DB_USERNAME` |
   | Password | `DB_PASSWORD` |
   | Database name | `DB_DATABASE` (usually `defaultdb`) |

3. **CA certificate** — same screen → **CA certificate** → download → save as:

   ```text
   config/certs/aiven-ca.pem
   ```

   Keep `DB_SSL_CA_PATH=config/certs/aiven-ca.pem` in `.env`.

4. Generate Rails secrets (once per environment):

   ```bash
   echo "SECRET_KEY_BASE=$(openssl rand -hex 64)"
   echo "JWT_SECRET_KEY=$(openssl rand -hex 32)"
   ```

   Paste the output into `.env`.

5. Apply schema to Aiven (Compose v5 uses **`--env-from-file`**, not `--env-file`):

   ```bash
   set -a && source .env && set +a
   docker compose run --rm \
     -e RAILS_ENV -e DB_HOST -e DB_PORT -e DB_USERNAME -e DB_PASSWORD -e DB_DATABASE -e DB_SSL_CA_PATH \
     api bundle exec rails db:prepare
   ```

   `-e DB_HOST` (etc.) pulls from your shell so they **override** `DB_HOST=mysql` in `docker-compose.yml`.

## Local Docker vs Aiven

- **`docker compose up`** uses the **local** MySQL in `docker-compose.yml` (`DB_HOST=mysql`). It does **not** need `.env` for the database.
- **`.env`** is for talking to **Aiven** (migrations, production checks) and optional keys like SMS.

## When something changes (next time)

| Change | What to update |
|--------|----------------|
| Aiven password reset | `DB_PASSWORD` in `.env` **and** Render → Environment |
| New Aiven service / host | All `DB_*` values + new CA file |
| New machine / teammate | `cp .env.example .env`, fill from Aiven + new generated secrets |
| Render deploy | Dashboard → Web Service → **Environment** — add the same keys as `.env` (see below) |
| Redis on Render | Add `REDIS_URL` from Render Key Value |

### Render (mirror `.env`)

Minimum for the API web service:

- `RAILS_ENV=production`
- `DB_HOST`, `DB_PORT`, `DB_USERNAME`, `DB_PASSWORD`, `DB_DATABASE`
- `SECRET_KEY_BASE`, `JWT_SECRET_KEY`
- SSL: either **`DB_SSL_CA`** = full PEM text (paste from `aiven-ca.pem`), **or** bake cert in image and set `DB_SSL_CA_PATH`
- `REDIS_URL` when Sidekiq/Redis is added
- Push: set **`FIREBASE_SERVICE_ACCOUNT_JSON`** to a service-account JSON (`type`, `project_id`, `private_key`, `client_email`), or locally **`FIREBASE_SERVICE_ACCOUNT_FILE`**. If org policy blocks keys on the app project (`grower-kit-15fe4`), keep the existing `remember-fire` JSON and set **`FCM_PROJECT_ID=grower-kit-15fe4`**, then grant that service account **Firebase Cloud Messaging API Admin** on `grower-kit-15fe4`. Check with `bundle exec rails fcm:status`.
- Cron alerts: **`CRON_SECRET`** — GrowKit-prefixed password (`GrowKit-` + hex). Header `X-Cron-Secret` on `POST /internal/alerts/*`. Same value on Render and GitHub Actions. Generate: `echo "GrowKit-$(openssl rand -hex 24)"`.

Pre-deploy command on Render:

```bash
bundle exec rails db:prepare
```

## Optional: load `.env` in Docker Compose

For `FAST2SMS_*` without exporting in the shell, you can add to `docker-compose.yml` under `api`:

```yaml
env_file:
  - path: .env
    required: false
```

Compose `environment:` entries (e.g. `DB_HOST: mysql`) still override `.env` for local dev.