.env.example

## Secrets (do not commit a real .env)
#
# Required for `just e2e-public-relays`:
#
# - Allowlisted client key (so the deployed bot will accept your welcomes/messages).
PIKA_TEST_NSEC=nsec1...
#
# - Deployed bot identity.
PIKA_UI_E2E_BOT_NPUB=npub1...
#
# - Public relays used for MLS group traffic (kind 445).
PIKA_UI_E2E_RELAYS=wss://relay.primal.net,wss://nos.lol,wss://relay.damus.io
#
# - Key-package relays (kind 443 "protected" publishes).
PIKA_UI_E2E_KP_RELAYS=wss://nostr-pub.wellorder.net,wss://nostr-01.yakihonne.com,wss://nostr-02.yakihonne.com

## Local iOS device signing (not secret, but keep local)
#
# Simulator builds do not need this. For `just run-ios-device` / `just run-ios-device-console`:
#
# - Your Apple Team ID (Xcode -> Settings -> Accounts -> Team ID).
PIKA_IOS_DEVELOPMENT_TEAM=YOUR_TEAM_ID
#
# - Bundle ID to sign (must exist/be creatable in your team). Default debug is `org.pikachat.pika.dev`.
#   If that conflicts for you, pick your own (e.g., `com.yourname.pika.dev`).
PIKA_IOS_BUNDLE_ID=org.pikachat.pika.dev

## Local Android debug package (optional)
#
# Debug builds install as a separate package to avoid signature mismatch errors.
# Default is `org.pikachat.pika.dev`.
PIKA_ANDROID_APP_ID=org.pikachat.pika.dev

## Android release signing (required for `just android-release` / release CI)
#
# Age private key used to decrypt checked-in repo secrets. `sops`-based paths
# prefer `SOPS_AGE_KEY`; the legacy scripts still accept `AGE_SECRET_KEY`.
SOPS_AGE_KEY=AGE-SECRET-KEY-...
# Optional compatibility alias during the repo-secret migration.
AGE_SECRET_KEY=AGE-SECRET-KEY-...
#
# Optional local override for hardware-key identities (default: ~/configs/yubikeys/keys.txt).
PIKA_AGE_IDENTITY_FILE=~/configs/yubikeys/keys.txt