example.env

# Local configuration for this application -- COPY THIS FILE to .env:
#
#     cp example.env .env          # Windows: copy example.env .env
#
# This file holds the application's *secrets*: the session key, the OAuth
# client secrets and the database password.  Everything that is not secret --
# the port, the database path, the template folder -- lives in the CONFIG dict
# in app.py instead.
#
# On the names below: each one is spelled exactly as it is in app.config, so
# DATABASE_PASSWORD in this file is the config key DATABASE_PASSWORD.  The one
# exception is COMSOCWEBAPP_SECRET_KEY -- SECRET_KEY on its own is a name half
# of PyPI defines, so it gets a prefix here and lands in config as SECRET_KEY.
# (COMSOCWEBAPP_LANGUAGE is prefixed for the same reason: bare LANGUAGE is a
# POSIX locale variable.  This app sets its language in CONFIG instead.)
#
# app.py calls load_dotenv() on start-up, which reads the .env file sitting
# next to it into the environment; create_app then picks these keys up on its
# own.  The .env copy is listed in .gitignore, so the secrets you put in it
# never reach GitHub -- which is why this template, with every line commented
# out, is the file that is committed.  A missing .env, or a line left
# commented, simply changes nothing: the app still runs, with a development
# session key and with email + password login only.

# --- Session signing key ---------------------------------------------------
# The key that signs the session cookie.  Left commented, create_app falls back
# to the development key "dev", which is fine on your own machine and MUST NOT
# be used anywhere reachable: anyone knowing it can forge a login, including an
# admin login.  Generate one with
#
#     python -c "import secrets; print(secrets.token_hex(32))"
#
# COMSOCWEBAPP_SECRET_KEY=

# --- External login providers ----------------------------------------------
# Optional.  Install the extra first:
#
#     pip install "comsocwebapp[oauth] @ git+https://github.com/ariel-research/comsocwebapp"
#
# then uncomment a provider's two lines and paste in its client id and secret.
# A provider needs BOTH values to switch on, and the buttons then appear by
# themselves.  app.py prints the redirect URI to register with the provider.

# Google -- https://console.cloud.google.com/apis/credentials
# OAUTH_GOOGLE_CLIENT_ID=
# OAUTH_GOOGLE_CLIENT_SECRET=

# GitHub -- https://github.com/settings/developers
# OAUTH_GITHUB_CLIENT_ID=
# OAUTH_GITHUB_CLIENT_SECRET=

# ORCID -- https://orcid.org/developer-tools
# OAUTH_ORCID_CLIENT_ID=
# OAUTH_ORCID_CLIENT_SECRET=

# --- Database engine -------------------------------------------------------
# app.py spells its database out key by key in CONFIG -- DATABASE_ENGINE plus,
# for SQLite, the path in DATABASE_FILE.  None of that is secret, so it stays in
# app.py.  Only the password belongs here.
#
# To run on a server, install the [postgresql] or [mysql] extra, then either
#
# (a) edit CONFIG in app.py -- set DATABASE_ENGINE to postgresql (or mysql) and
#     uncomment DATABASE_HOST / DATABASE_PORT / DATABASE_NAME / DATABASE_USER
#     there -- and give the password, and only the password, here:
# DATABASE_PASSWORD=
#
# (b) or, for a quick try, give the whole connection as one URL.  This
#     overrides the CONFIG keys entirely, so app.py need not change -- but the
#     password then sits inside the URL, and @ / must be %40 %2F:
# DATABASE_URL=postgresql://user:password@localhost:5432/flat_division
# DATABASE_URL=mysql://user:password@localhost:3306/flat_division