Environment setup
How developers and operators configure local and deployed environments. Never put secret values in documentation—only names and intent.
Local development
- Package manager: Yarn in each app directory (
yarn install,yarn dev, etc.). - API: Copy
ethica-api/.env.exampleto.envand fill in values for your machine.DATABASE_URLshould point at a local or shared dev PostgreSQL instance. - Frontends: Each Next.js app uses its own env files (e.g.
.env.local) for publicNEXT_PUBLIC_*variables and API base URLs so the browser calls the correctethica-apiorigin.
Deployed environments
- Netlify (frontends): Set environment variables in the Netlify UI per site (preview vs production as needed).
- DigitalOcean (API + database): Set secrets on the app and managed database; the API process receives
DATABASE_URLand integration keys the same way as locally, without committing them.
Variable categories (ethica-api)
The authoritative list with comments is ethica-api/.env.example. Grouped by concern:
| Category | Examples (names only) |
|---|---|
| Database | DATABASE_URL, PORT |
| Staff auth / sessions | JWT_SECRET, JWT_EXPIRES_IN, SESSION_IDLE_MINUTES, BCRYPT_SALT_ROUNDS |
| Staff MFA | MFA_ENCRYPTION_KEY, MFA_STEP_UP_HOURS, MFA_ISSUER_NAME, MFA_DISABLED, SKIP_MFA_IN_DEV, MFA_DEV_ALWAYS_STEP_UP, MFA_ENFORCEMENT_REQUIRED |
| Customer auth / MFA | CUSTOMER_MFA_ISSUER, CUSTOMER_MFA_ENCRYPTION_KEY |
RESEND_API_KEY, MAIL_FROM, optional SEND_TEST_EMAIL_TO (dev) | |
| Uploads | CLOUDINARY_CLOUD_NAME, CLOUDINARY_API_KEY, CLOUDINARY_API_SECRET |
| SMS | INFO_BIP_API_KEY, INFO_BIP_BASE_URL |
| Customer portal links / legal | CUSTOMER_PORTAL_BASE_URL, CUSTOMER_PORTAL_TERMS_VERSION |
| Feature modules | MODULE_CUSTOMERS, MODULE_INVESTMENTS, MODULE_FINANCE, MODULE_ANALYTICS — set to false to disable a module (see ethica-api/src/app.module.ts). |
Frontends may define their own variables (e.g. terms version must stay aligned with API expectations where documented in .env.example).