# REQUIRED CORE

flyctl secrets set APP_NAME=YOUR_APP_NAME \
DATABASE_URL=postgres://{USER}:{PASSWORD}@{HOST}:{PORT}/{DATABASE} \
SESSION_SECRET=<session-secret> \
CRYPTO_SECRET=<crypto-secret> \
API_ACCESS_TOKEN=<api-access-token> \
JWT_SECRET=<jwt-secret> \
APP_BASE_DOMAIN=your-domain.invalid \
WEB_APP_HOST=app.your-domain.invalid \
ADMIN_APP_HOST=admin.your-domain.invalid \
API_HOST=api.your-domain.invalid \
APP_PROTOCOL=https \
--app YOUR_APP_NAME

# APP AND PROVIDER SECRETS

flyctl secrets set APP_NAME=YOUR_APP_NAME \
DATABASE_URL=postgres://{USER}:{PASSWORD}@{HOST}:{PORT}/{DATABASE} \
SESSION_SECRET=<session-secret> \
CRYPTO_SECRET=<crypto-secret> \
API_ACCESS_TOKEN=<api-access-token> \
JWT_SECRET=<jwt-secret> \
APP_BASE_DOMAIN=your-domain.invalid \
WEB_APP_HOST=app.your-domain.invalid \
ADMIN_APP_HOST=admin.your-domain.invalid \
API_HOST=api.your-domain.invalid \
APP_PROTOCOL=https \
STORAGE_ENDPOINT=https://s3.your-domain.invalid \
STORAGE_REGION=us-east-1 \
STORAGE_BUCKET=toolctrl-exports \
STORAGE_ACCESS_KEY_ID=<storage-access-key-id> \
STORAGE_SECRET_ACCESS_KEY=<storage-secret-access-key> \
STORAGE_SESSION_TOKEN= \
STORAGE_PUBLIC_BASE_URL=https://cdn.your-domain.invalid \
STORAGE_FORCE_PATH_STYLE=false \
STRIPE_SK=<stripe-secret-key> \
STRIPE_WEBHOOK_SIGNING_SECRET=<stripe-webhook-signing-secret> \
STRIPE_ACCOUNT_COUNTRY=US \
MAILJET_API_KEY=<mailjet-api-key> \
MAILJET_SECRET_KEY=<mailjet-secret-key> \
MAILJET_FROM_EMAIL=notifications@example.com \
MAILJET_FROM_NAME=ToolCTRL \
SUPPORT_EMAIL=support@example.com \
COMPANY_NAME=ExampleCo \
COMPANY_ADDRESS="Example address" \
INTEGRATIONS_CONTACT_FORMSPREE=https://formspree.io/f/example \
ANALYTICS_TOKEN=<analytics-token> \
MCAPTCHA_INSTANCE_URL=<mcaptcha-instance-url> \
MCAPTCHA_ACCOUNT_SECRET=<mcaptcha-account-secret> \
MCAPTCHA_SITEKEY_LOGIN=<mcaptcha-sitekey-login> \
MCAPTCHA_SITEKEY_FORMS=<mcaptcha-sitekey-forms> \
MCAPTCHA_SITEKEY_BOOKING=<mcaptcha-sitekey-booking> \
AUTH_MAGIC_LINK_ENABLED=false \
AUTH_MAGIC_LINK_TOKEN_TTL_MINUTES=15 \
NOTIFICATIONS_NOVU_API_KEY=<novu-api-key> \
EXPORT_RETENTION_QUEUE_ENABLED=false \
IMPORT_QUEUE_ENABLED=false \
BULLMQ_REDIS_URL=redis://default:<redis-password>@redis.your-domain.invalid:6379/0 \
BROWSER_RUNTIME_URL=https://browser-runtime.your-domain.invalid \
BROWSER_RUNTIME_API_KEY=<browser-runtime-api-key> \
BROWSER_SESSION_TIMEOUT_MS=60000 \
IPSTACK_API_KEY=<ipstack-api-key> \
IPAPIIS_API_KEY=<ipapiis-api-key> \
--app YOUR_APP_NAME

# REDIS_URL is a fallback only when BULLMQ_REDIS_URL is absent; keep it commented if a platform injects it.
# REDIS_URL=redis://default:<redis-password>@redis.example.com:6379/0

# PORTAL SECRETS

flyctl secrets set PORTAL_SERVER_URL=https://portal.your-domain.invalid \
PORTAL_SERVER_FLY_TOKEN="FlyV1 <portal-token>" \
--app YOUR_APP_NAME