.env.example

# JSON:API Frontend - Next.js Starter Environment Variables
# Copy this file to .env.local and configure for your environment.

# =============================================================================
# REQUIRED
# =============================================================================

# The base URL of your Drupal site (used for API calls)
DRUPAL_BASE_URL=https://your-drupal-site.com

# =============================================================================
# DEPLOYMENT MODE
# =============================================================================

# Deployment mode determines how traffic flows between Next.js and Drupal.
#
# 'split_routing' (default)
#   - Drupal stays on main domain
#   - External router (Cloudflare, nginx) directs specific paths to Next.js
#   - No DNS change required
#   - Proxy is disabled
#
# 'nextjs_first'
#   - Next.js on main domain, handles all traffic
#   - Non-headless content is proxied to Drupal origin
#   - Best performance, requires DNS change
#   - Proxy is enabled
#
DEPLOYMENT_MODE=split_routing

# =============================================================================
# NEXT.JS FIRST MODE (only needed if DEPLOYMENT_MODE=nextjs_first)
# =============================================================================

# Drupal origin URL (where Drupal is accessible after DNS change)
# This is where the proxy sends non-headless requests.
# Often a subdomain like cms.example.com or the server's direct IP.
# DRUPAL_ORIGIN_URL=https://cms.example.com

# Proxy secret for origin protection (REQUIRED for production)
# Get this from your Drupal admin: /admin/config/services/jsonapi-frontend
# Drupal will reject direct requests that don't include this secret.
# DRUPAL_PROXY_SECRET=your-secret-from-drupal-admin

# =============================================================================
# CACHE REVALIDATION
# =============================================================================

# Secret for webhook-based cache revalidation (REQUIRED for production)
# Must match the "Revalidation secret" in Drupal admin at
# /admin/config/services/jsonapi-frontend
# When Drupal content changes, it sends a webhook to /api/revalidate
# which invalidates Next.js cache tags for instant content updates.
REVALIDATION_SECRET=your-secret-from-drupal-admin

# =============================================================================
# IMAGE SECURITY
# =============================================================================

# Restrict which domains can serve images (RECOMMENDED for production)
# Without this, any domain can be used for image sources.
# Set to your Drupal domain for security.
# If omitted, Next will derive it from DRUPAL_BASE_URL (same host).
# You can pass multiple hosts as a comma-separated list.
# DRUPAL_IMAGE_DOMAIN=cms.example.com,assets.example.com

# =============================================================================
# AUTHENTICATION (optional)
# =============================================================================

# If your Drupal JSON:API requires auth, set ONE of these (server-side only).
# When auth is configured, this starter disables Next.js fetch caching to avoid
# leaking access-controlled content across users.
#
# JWT (via Drupal's auth stack; requires a JWT/auth module in Drupal):
# DRUPAL_JWT_TOKEN=abc123
#
# Basic auth:
# DRUPAL_BASIC_USERNAME=editor
# DRUPAL_BASIC_PASSWORD=editor