Configuration

Start with .env.example. Never commit .env, credentials, or SQLite databases.

Variable	Purpose
`APP_KEY`	Encryption and signatures; use the same key in web and worker.
`APP_URL`	Canonical dashboard URL and OAuth callback origin.
`DATABASE_URL`	PostgreSQL connection in production.
`SOCIAL_GOOGLE_CLIENT_ID` / `SOCIAL_GOOGLE_CLIENT_SECRET`	Google OAuth Web client.
`MAIL_MAILER` / `RESEND_API_KEY`	Resend delivery when `MAIL_MAILER=resend`.
`QUEUE_CONNECTION`	Use `database` for a persistent queue.

When rotating APP_KEY, keep older keys in APP_PREVIOUS_KEYS while existing sessions and signed links remain valid. Set APP_DEBUG=false in production.