# Copy to env_secrets.yaml (gitignored) for a manual deploy, or have CI render it
# from repository secrets - which is what .github/workflows/deploy.yml does.
#
# app.yaml `includes:` this file, so App Engine sees these as env vars without
# them ever touching git.
#
# The split this file is one half of:
#
#   app.yaml            a host, an id, a public address, a flag - committed
#   env_secrets.yaml    anything that authenticates - never committed
#
# An unset secret renders as an empty string, which settings.py reads as
# "feature off" - so a line is safe to keep here before its secret exists.
env_variables:
  DB_PASS: "<the database user's password>"
  SECRET_KEY: "<a real random value - signs the session cookie>"
  # The mailbox password. The rest of the SMTP config (host, port, user, from) is
  # non-secret and lives in app.yaml.
  SMTP_PASS: "<the SMTP mailbox password>"
  # Google sign-in. The client id is not strictly a secret - it is in every
  # consent URL - but it lives here so all of Google's config is in one place and
  # so that leaving both unset is the single act that turns the feature off.
  # Register the client at console.cloud.google.com/apis/credentials with the
  # redirect URI <PUBLIC_BASE_URL>/auth/google/callback.
  GOOGLE_CLIENT_ID: "<….apps.googleusercontent.com>"
  GOOGLE_CLIENT_SECRET: "<the OAuth client secret>"