# Production Env Example

This file is the sanitized target contract rendered by the Prod prepare step.
It is not evidence that the values are already active in Prod; bind live claims
to an exact release env and runtime readback.

## Public contract

```dotenv
ENV_NAME=prod
ENV_ROOT=/home/ubuntu/nexuscrm-deployment/online/envs/prod
DOWNSTREAM_REF=main
UPSTREAM_REF=main
OFFICIAL_APP_PACKS_REF=main
BACKEND_PORT=3103
PUBLIC_BASE_URL=https://nexuscrm-new-prod.pingcap.com
SERVER_NAME=d3exqhsoofemz1.cloudfront.net
TIDB_DATABASE=nexuscrm
TIDB_TLS=true
RESET_DB=0
RUN_SETUP_APPLY_METADATA=0
RUN_SETUP_APPLY_PACKS=0
RUN_SETUP_APPLY=0
RUN_SETUP_REBUILD=0
SETUP_SKIP_POLYMORPHIC_BACKFILL=false
ENSURE_INDEXES_WORKERS=1
RUN_STACK_SEED_APP_SHELL=0
FILE_STORAGE_PROVIDER=s3
FILE_STORAGE_BUCKET=nexus-crm-files-prod
FILE_STORAGE_REGION=us-west-2
FILE_STORAGE_PREFIX=prod/customer-files/v1
FILE_STORAGE_ROOT=/home/ubuntu/nexuscrm-deployment/online/envs/multi_prod/shared/data/object-storage
FILE_STORAGE_LEGACY_UPLOAD_ROOT=/home/ubuntu/nexuscrm-deployment/online/envs/multi_prod/shared/data/uploads
NEXUSCRM_DOWNLOAD_ARTIFACT_STORAGE_ROOT=/home/ubuntu/nexuscrm-deployment/online/envs/multi_prod/releases/<release-tag>/runtime-data/connect-artifacts
```

## Runner-materialized public URL contract

The generated runner must currently export:

```dotenv
API_BASE_URL=https://nexuscrm-new-prod.pingcap.com
FRONTEND_URL=https://nexuscrm-new-prod.pingcap.com
PORT=3103
NEXUS_ENV=production
NODE_ENV=production
FILE_STORAGE_PROVIDER=s3
FILE_STORAGE_BUCKET=nexus-crm-files-prod
FILE_STORAGE_REGION=us-west-2
FILE_STORAGE_PREFIX=prod/customer-files/v1
NEXUSCRM_DOWNLOAD_ARTIFACT_STORAGE_ROOT=/home/ubuntu/nexuscrm-deployment/online/envs/multi_prod/releases/<release-tag>/runtime-data/connect-artifacts
```

## Secret-bearing keys not recorded here

1. `TIDB_USER`
2. `TIDB_PASSWORD`
3. `JWT_SECRET`
4. `NEXUS_ADMIN_PASSWORD`
5. `GH_TOKEN`

## Notes

1. `PUBLIC_BASE_URL` is the browser-facing source of truth
2. `SERVER_NAME` may include the origin-routed CloudFront hostname during migration or debugging
3. changing only the env file is not enough if the generated runner still contains old `API_BASE_URL` or `FRONTEND_URL` values
4. customer-file roots must never resolve below `releases/<release-tag>`; see `docs/deal-document-storage-lifecycle.md`