🚧 WIP

.env.example

@@ -0,0 +1,47 @@
+# MQTT Management Platform — example environment file
+# Copy to .env and fill in real values. NEVER commit .env to Git.
+
+APP_ENV=development
+
+# --- Management application administrator (spec §7.1) ---
+# Only used during initial backend bootstrap; ignored once an admin exists.
+ADMIN_INITIAL_USERNAME=admin
+ADMIN_INITIAL_PASSWORD=change-me-admin
+
+# --- PostgreSQL ---
+DATABASE_USER=mqttadmin
+DATABASE_PASSWORD=change-me-db
+DATABASE_NAME=mqttadmin
+# DATABASE_HOST / DATABASE_PORT are fixed inside compose (mqtt-db:5432);
+# listed for local dev runs outside compose.
+DATABASE_HOST=mqtt-db
+DATABASE_PORT=5432
+
+# --- Secrets ---
+# 32+ byte random strings. Generate e.g.:
+#   openssl rand -hex 32
+SESSION_SECRET=change-me-session-secret-32-bytes-min
+SECRET_ENCRYPTION_KEY=change-me-encryption-key-32-bytes
+
+# --- Mosquitto dynamic security bootstrap (spec §7) ---
+# Consumed by the dynsec plugin on first broker start (2.1 feature).
+MOSQUITTO_DYNSEC_USERNAME=admin
+MOSQUITTO_DYNSEC_PASSWORD=change-me-dynsec
+
+# --- Broker connection (backend -> mosquitto, internal network) ---
+MOSQUITTO_HOST=mosquitto
+MOSQUITTO_MGMT_PORT=1883
+
+# --- Control sidecar ---
+# Shared secret between backend and mosquitto-control (backend-net only).
+CONTROL_API_TOKEN=change-me-control-token
+
+# --- TLS / PKI defaults (used from Release 2 onwards) ---
+DEFAULT_TLS_MIN_VERSION=tlsv1.2
+DEFAULT_CERT_VALIDITY_DAYS=365
+DEFAULT_CA_VALIDITY_DAYS=3650
+
+# --- Frontend ---
+# Non-secret build arg only; see compose.yaml (spec §7.2).
+VITE_API_BASE_URL=/api/v1
+FRONTEND_PORT=8080