[chore] replace tracked env defaults with safe examples

.gitignore

@@ -6,11 +6,15 @@
 # Backend
 backend/vendor/
 backend/var/
+backend/.env
 backend/.env.local
+backend/.env.*
 backend/.env.*.local
 backend/phpunit.xml.dist
 backend/phpunit.result.cache
-!backend/.env
+!backend/.env.example
+backend/config/jwt/*.pem
+backend/config/secrets/prod/prod.decrypt.private.php
 
 # Frontend
 frontend/node_modules/
@@ -19,6 +23,9 @@ frontend/packages/*/node_modules/
 frontend/.next/
 frontend/dist/
 frontend/build/
+frontend/.env
+frontend/.env.*
+!frontend/.env.example
 frontend/.pnp.*
 frontend/.yarn/*
 !frontend/.yarn/patches

README.md

@@ -53,6 +53,10 @@
 
 API — это не тупая CRUD-машина. Это шлюз для интеграции с внешним миром
 
+Configuration setup is documented in `docs/configuration.md`. Use
+`backend/.env.example` and `frontend/.env.example` as safe local templates; keep
+real `.env` files untracked.
+
 ### Ключевые эндпоинты:
 - `GET /api/v1/products/search`: Дергает `ProductSearchQuery`, который прокидывает хитрый запрос в Elasticsearch, бустит SKU (шоб артикулы летали) и динамически тащит фасеты. Изящно хендлит отвал эластика (отдаем пустоту, чтоб фронт не сложился как карточный домик с 500-й).
 - `POST /api/v1/auth/{provider}/start`: Ручка хард-редиректа на Google/GitHub. Заставляет браузер схавать `PHPSESSID` куку.

backend/.env.example

@@ -0,0 +1,20 @@
+APP_ENV=dev
+APP_SECRET=change-me-local-only
+APP_SHARE_DIR=var/share
+DEFAULT_URI=http://localhost
+
+DATABASE_URL="postgresql://app:change-me@127.0.0.1:5432/app?serverVersion=16&charset=utf8"
+CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
+MESSENGER_TRANSPORT_DSN=doctrine://default?auto_setup=0
+
+JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
+JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
+JWT_PASSPHRASE=change-me-local-only
+
+GOOGLE_CLIENT_ID=replace-me
+GOOGLE_CLIENT_SECRET=replace-me
+GOOGLE_REDIRECT_URL=http://localhost:8000/auth/google/callback
+
+GITHUB_CLIENT_ID=replace-me
+GITHUB_CLIENT_SECRET=replace-me
+GITHUB_REDIRECT_URL=http://localhost:8000/auth/github/callback

backend/.gitignore

@@ -2,7 +2,10 @@
 ###> symfony/framework-bundle ###
 /.env.local
 /.env.local.php
+/.env
 /.env.*.local
+/.env.*
+!/.env.example
 /config/secrets/prod/prod.decrypt.private.php
 /public/bundles/
 /var/

docs/configuration.md

@@ -0,0 +1,42 @@
+# Configuration
+
+OmniPIM keeps runtime configuration in local env files and commits only safe
+examples.
+
+## Backend
+
+Create a backend env file from the example:
+
+```bash
+cp backend/.env.example backend/.env
+```
+
+Important variables:
+
+| Variable | Purpose |
+| --- | --- |
+| `APP_SECRET` | Symfony app secret for local/dev runtime. |
+| `DATABASE_URL` | PostgreSQL connection string. |
+| `MESSENGER_TRANSPORT_DSN` | Messenger transport for async jobs. |
+| `JWT_SECRET_KEY` / `JWT_PUBLIC_KEY` | LexikJWT key paths. |
+| `JWT_PASSPHRASE` | Local JWT key passphrase. |
+| `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` | Google OAuth app credentials. |
+| `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` | GitHub OAuth app credentials. |
+
+## Secret rules
+
+- Do not commit `backend/.env`.
+- Do not commit JWT private/public `.pem` files.
+- Use placeholder values only in `.env.example`.
+- Prefer real environment variables in production deployments.
+
+## Frontend
+
+Create frontend variables from the example:
+
+```bash
+cp frontend/.env.example frontend/.env.local
+```
+
+`NEXT_PUBLIC_*` variables are exposed to the browser. Do not put secrets in
+frontend env files.

frontend/.env.example

@@ -0,0 +1,4 @@
+NEXT_PUBLIC_API_BASE_URL=http://localhost:8000
+NEXT_PUBLIC_ADMIN_URL=http://localhost:3000
+NEXT_PUBLIC_PUBLIC_CATALOG_URL=http://localhost:3001
+NEXT_PUBLIC_SUPPLIER_PORTAL_URL=http://localhost:3002