From cd1c00d3427cd3acd842137056294a97a8495c02 Mon Sep 17 00:00:00 2001
From: Akmal <hujdarovakmal@gmail.com>
Date: Sat, 9 May 2026 17:07:10 +0500
Subject: [PATCH 1/7] chore: remove tracked backend env file

---
 backend/.env | 64 ----------------------------------------------------
 1 file changed, 64 deletions(-)
 delete mode 100644 backend/.env

diff --git a/backend/.env b/backend/.env
deleted file mode 100644
index a65fdc8..0000000
--- a/backend/.env
+++ /dev/null
@@ -1,64 +0,0 @@
-# In all environments, the following files are loaded if they exist,
-# the latter taking precedence over the former:
-#
-#  * .env                contains default values for the environment variables needed by the app
-#  * .env.local          uncommitted file with local overrides
-#  * .env.$APP_ENV       committed environment-specific defaults
-#  * .env.$APP_ENV.local uncommitted environment-specific overrides
-#
-# Real environment variables win over .env files.
-#
-# DO NOT DEFINE PRODUCTION SECRETS IN THIS FILE NOR IN ANY OTHER COMMITTED FILES.
-# https://symfony.com/doc/current/configuration/secrets.html
-#
-# Run "composer dump-env prod" to compile .env files for production use (requires symfony/flex >=1.2).
-# https://symfony.com/doc/current/best_practices.html#use-environment-variables-for-infrastructure-configuration
-
-###> symfony/framework-bundle ###
-APP_ENV=dev
-APP_SECRET=
-APP_SHARE_DIR=var/share
-###< symfony/framework-bundle ###
-
-###> symfony/routing ###
-# Configure how to generate URLs in non-HTTP contexts, such as CLI commands.
-# See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
-DEFAULT_URI=http://localhost
-###< symfony/routing ###
-
-###> doctrine/doctrine-bundle ###
-# Format described at https://www.doctrine-project.org/projects/doctrine-dbal/en/latest/reference/configuration.html#connecting-using-a-url
-# IMPORTANT: You MUST configure your server version, either here or in config/packages/doctrine.yaml
-#
-# DATABASE_URL="sqlite:///%kernel.project_dir%/var/data_%kernel.environment%.db"
-# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=8.0.32&charset=utf8mb4"
-# DATABASE_URL="mysql://app:!ChangeMe!@127.0.0.1:3306/app?serverVersion=10.11.2-MariaDB&charset=utf8mb4"
-DATABASE_URL="postgresql://app:!ChangeMe!@127.0.0.1:5432/app?serverVersion=16&charset=utf8"
-###< doctrine/doctrine-bundle ###
-
-###> nelmio/cors-bundle ###
-CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
-###< nelmio/cors-bundle ###
-
-###> symfony/messenger ###
-# Choose one of the transports below
-# MESSENGER_TRANSPORT_DSN=amqp://guest:guest@localhost:5672/%2f/messages
-# MESSENGER_TRANSPORT_DSN=redis://localhost:6379/messages
-MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
-###< symfony/messenger ###
-
-###> lexik/jwt-authentication-bundle ###
-JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
-JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
-JWT_PASSPHRASE=db1495d31a1698f83cf45763108ca1d54eac6da0476b59c8e20e5255a12f5201
-###< lexik/jwt-authentication-bundle ###
-
-###> oauth2-sso ###
-GOOGLE_CLIENT_ID="mock_google_client_id"
-GOOGLE_CLIENT_SECRET="mock_google_secret"
-GOOGLE_REDIRECT_URL="http://localhost:8000/auth/google/callback"
-
-GITHUB_CLIENT_ID="mock_github_client_id"
-GITHUB_CLIENT_SECRET="mock_github_secret"
-GITHUB_REDIRECT_URL="http://localhost:8000/auth/github/callback"
-###< oauth2-sso ###

From 4bef360c08b818301ecbb6b4b0ae1ae0714ee09a Mon Sep 17 00:00:00 2001
From: Akmal <hujdarovakmal@gmail.com>
Date: Sat, 9 May 2026 17:07:23 +0500
Subject: [PATCH 2/7] chore: add backend env example

---
 backend/.env.example | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 backend/.env.example

diff --git a/backend/.env.example b/backend/.env.example
new file mode 100644
index 0000000..88473ce
--- /dev/null
+++ b/backend/.env.example
@@ -0,0 +1,20 @@
+APP_ENV=dev
+APP_SECRET=change-me-local-only
+APP_SHARE_DIR=var/share
+DEFAULT_URI=http://localhost
+
+DATABASE_URL="postgresql://app:change-me@127.0.0.1:5432/app?serverVersion=16&charset=utf8"
+CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
+MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
+
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+JWT_PASSPHRASE=change-me-local-only
+
+GOOGLE_CLIENT_ID=replace-me
+GOOGLE_CLIENT_SECRET=replace-me
+GOOGLE_REDIRECT_URL=http://localhost:8000/auth/google/callback
+
+GITHUB_CLIENT_ID=replace-me
+GITHUB_CLIENT_SECRET=replace-me
+GITHUB_REDIRECT_URL=http://localhost:8000/auth/github/callback

From 387782b9946a865b027c72b71c52b66bca2c054a Mon Sep 17 00:00:00 2001
From: Akmal <hujdarovakmal@gmail.com>
Date: Sat, 9 May 2026 17:07:43 +0500
Subject: [PATCH 3/7] chore: ignore local backend env files

---
 .gitignore | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 5986e47..e4b5d0f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,11 +6,15 @@
 # Backend
 backend/vendor/
 backend/var/
+backend/.env
 backend/.env.local
+backend/.env.*
 backend/.env.*.local
 backend/phpunit.xml.dist
 backend/phpunit.result.cache
-!backend/.env
+!backend/.env.example
+backend/config/jwt/*.pem
+backend/config/secrets/prod/prod.decrypt.private.php
 
 # Frontend
 frontend/node_modules/

From 55c2d710fcc565596d50adbc55896dff320cba93 Mon Sep 17 00:00:00 2001
From: Akmal <hujdarovakmal@gmail.com>
Date: Sat, 9 May 2026 17:07:55 +0500
Subject: [PATCH 4/7] chore: protect backend secret artifacts

---
 backend/.gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/backend/.gitignore b/backend/.gitignore
index 94a2aab..0d394da 100644
--- a/backend/.gitignore
+++ b/backend/.gitignore
@@ -2,7 +2,10 @@
 ###> symfony/framework-bundle ###
 /.env.local
 /.env.local.php
+/.env
 /.env.*.local
+/.env.*
+!/.env.example
 /config/secrets/prod/prod.decrypt.private.php
 /public/bundles/
 /var/

From f0a96846ecc8900f441458c19921a899916b4276 Mon Sep 17 00:00:00 2001
From: Akmal <hujdarovakmal@gmail.com>
Date: Sat, 9 May 2026 17:08:14 +0500
Subject: [PATCH 5/7] docs: document backend configuration variables

---
 docs/configuration.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 docs/configuration.md

diff --git a/docs/configuration.md b/docs/configuration.md
new file mode 100644
index 0000000..f17eee2
--- /dev/null
+++ b/docs/configuration.md
@@ -0,0 +1,31 @@
+# Configuration
+
+OmniPIM keeps runtime configuration in local env files and commits only safe
+examples.
+
+## Backend
+
+Create a backend env file from the example:
+
+```bash
+cp backend/.env.example backend/.env
+```
+
+Important variables:
+
+| Variable | Purpose |
+| --- | --- |
+| `APP_SECRET` | Symfony app secret for local/dev runtime. |
+| `DATABASE_URL` | PostgreSQL connection string. |
+| `MESSENGER_TRANSPORT_DSN` | Messenger transport for async jobs. |
+| `JWT_SECRET_KEY` / `JWT_PUBLIC_KEY` | LexikJWT key paths. |
+| `JWT_PASSPHRASE` | Local JWT key passphrase. |
+| `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | Google OAuth app credentials. |
+| `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` | GitHub OAuth app credentials. |
+
+## Secret rules
+
+- Do not commit `backend/.env`.
+- Do not commit JWT private/public `.pem` files.
+- Use placeholder values only in `.env.example`.
+- Prefer real environment variables in production deployments.

From 3ce99c93995fa148553f90e401373c3c951a3d68 Mon Sep 17 00:00:00 2001
From: Akmal <hujdarovakmal@gmail.com>
Date: Sat, 9 May 2026 17:08:28 +0500
Subject: [PATCH 6/7] docs: add frontend env example

---
 docs/configuration.md | 11 +++++++++++
 frontend/.env.example |  4 ++++
 2 files changed, 15 insertions(+)
 create mode 100644 frontend/.env.example

diff --git a/docs/configuration.md b/docs/configuration.md
index f17eee2..825bb84 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -29,3 +29,14 @@ Important variables:
 - Do not commit JWT private/public `.pem` files.
 - Use placeholder values only in `.env.example`.
 - Prefer real environment variables in production deployments.
+
+## Frontend
+
+Create frontend variables from the example:
+
+```bash
+cp frontend/.env.example frontend/.env.local
+```
+
+`NEXT_PUBLIC_*` variables are exposed to the browser. Do not put secrets in
+frontend env files.
diff --git a/frontend/.env.example b/frontend/.env.example
new file mode 100644
index 0000000..3e07620
--- /dev/null
+++ b/frontend/.env.example
@@ -0,0 +1,4 @@
+NEXT_PUBLIC_API_BASE_URL=http://localhost:8000
+NEXT_PUBLIC_ADMIN_URL=http://localhost:3000
+NEXT_PUBLIC_PUBLIC_CATALOG_URL=http://localhost:3001
+NEXT_PUBLIC_SUPPLIER_PORTAL_URL=http://localhost:3002

From c87ca9a81bbe341a0b3eaec38fc4d30e77f4c01b Mon Sep 17 00:00:00 2001
From: Akmal <hujdarovakmal@gmail.com>
Date: Sat, 9 May 2026 17:08:57 +0500
Subject: [PATCH 7/7] docs: link safe configuration templates

---
 .gitignore | 3 +++
 README.md  | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/.gitignore b/.gitignore
index e4b5d0f..b094546 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,6 +23,9 @@ frontend/packages/*/node_modules/
 frontend/.next/
 frontend/dist/
 frontend/build/
+frontend/.env
+frontend/.env.*
+!frontend/.env.example
 frontend/.pnp.*
 frontend/.yarn/*
 !frontend/.yarn/patches
diff --git a/README.md b/README.md
index e187e06..1d63ddc 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,10 @@
 
 API — это не тупая CRUD-машина. Это шлюз для интеграции с внешним миром
 
+Configuration setup is documented in `docs/configuration.md`. Use
+`backend/.env.example` and `frontend/.env.example` as safe local templates; keep
+real `.env` files untracked.
+
 ### Ключевые эндпоинты:
 - `GET /api/v1/products/search`: Дергает `ProductSearchQuery`, который прокидывает хитрый запрос в Elasticsearch, бустит SKU (шоб артикулы летали) и динамически тащит фасеты. Изящно хендлит отвал эластика (отдаем пустоту, чтоб фронт не сложился как карточный домик с 500-й).
 - `POST /api/v1/auth/{provider}/start`: Ручка хард-редиректа на Google/GitHub. Заставляет браузер схавать `PHPSESSID` куку.