testing 127.0.0.1 issue

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

.env-development

@@ -0,0 +1,98 @@
+# ═══════════════════════════════════════════════════════════════════════════════
+#  $APP_NAME — Environment Variables Template (LOCAL DEVELOPMENT)
+#  Copy to .env and fill in the CHANGE_ME values before running `npm run dev`.
+#
+#  Local development setup:
+#    1. cp .env-development .env
+#    2. Fill in every CHANGE_ME value below
+#    3. npm install
+#    4. npm run dev        (nodemon, auto-restarts on file change)
+#
+#  For a production / self-hosted deployment (Docker Compose, Redis, TLS),
+#  use .env-production instead — see docker-compose.yml.
+#
+#  Generate random secrets with:
+#    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+# ═══════════════════════════════════════════════════════════════════════════════
+
+# ── App ───────────────────────────────────────────────────────────────────────
+APP_NAME=starr
+NODE_ENV=development
+ORIGIN_GUARD_DISABLED=true   # allows Postman/curl in dev; hard-locked false when NODE_ENV=production
+PORT=3024
+APP_URL=http://localhost:3024
+APP_LOGO_URL=https://your-cdn.com/logo.png
+FRONTEND_URL=http://localhost:5173
+
+# ── Database (PostgreSQL) ─────────────────────────────────────────────────────
+#  Local Postgres install — no SSL needed.
+DB_HOST=127.0.0.1
+DB_PORT=5432
+DB_NAME=CHANGE_ME
+DB_USER=CHANGE_ME
+DB_PASSWORD=CHANGE_ME
+DB_SSL=false
+DB_FORCE_SYNC=false   # never drop tables — even in dev, unless you mean it
+
+# ── Cache driver ──────────────────────────────────────────────────────────────
+#  memory → no Redis/Valkey needed. Safe default for a single local process.
+#  Rate limit counters and CSRF sessions reset on restart — fine for dev.
+CACHE_DRIVER=memory
+
+# ── JWT ───────────────────────────────────────────────────────────────────────
+#  Generate each secret independently — never reuse across fields.
+JWT_SECRET=CHANGE_ME_32_BYTE_HEX
+MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
+JWT_EXPIRES_IN=15m
+JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
+JWT_REFRESH_EXPIRES_IN=7d
+
+# ── CSRF & Cookies ────────────────────────────────────────────────────────────
+SESSION_SECRET=CHANGE_ME_32_BYTE_HEX
+
+# ── Google OAuth ──────────────────────────────────────────────────────────────
+#  console.cloud.google.com → Credentials → OAuth 2.0 Client ID
+#  Add http://localhost:3024/api/auth/google/callback to Authorized redirect URIs
+GOOGLE_CLIENT_ID=CHANGE_ME
+GOOGLE_CLIENT_SECRET=CHANGE_ME
+GOOGLE_CALLBACK_URL=http://localhost:3024/api/auth/google/callback
+
+# ── PayPal ────────────────────────────────────────────────────────────────────
+#  Use Sandbox credentials for local testing: developer.paypal.com → Sandbox tab.
+PAYPAL_CLIENT_ID=CHANGE_ME
+PAYPAL_CLIENT_SECRET=CHANGE_ME
+PAYPAL_ENV=sandbox
+
+# ── Email (SMTP) ──────────────────────────────────────────────────────────────
+#  Gmail: enable 2FA → generate an App Password at myaccount.google.com/apppasswords
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=CHANGE_ME@gmail.com
+SMTP_PASS=CHANGE_ME_APP_PASSWORD
+EMAIL_FROM=CHANGE_ME@gmail.com
+
+OTP_EXPIRY_MINUTES=10
+
+# ── S3-compatible Storage (Garage, run locally — bare-metal) ─────────────────
+#  Run Garage directly on your machine (the docker-compose.yml Garage service
+#  is set up for the production stack). See:
+#  https://garagehq.deuxfleurs.fr/documentation/quick-start/
+S3_ENDPOINT=http://127.0.0.1:3900
+S3_REGION=garage
+S3_ACCESS_KEY=CHANGE_ME
+S3_SECRET_KEY=CHANGE_ME
+S3_BUCKET=CHANGE_ME
+S3_PUBLIC_URL=http://127.0.0.1:3900
+
+# ── Chibisafe (optional — used alongside S3 for some asset types) ────────────
+CHIBISAFE_BASE_URL=CHANGE_ME
+CHIBISAFE_API_KEY=CHANGE_ME
+CHIBISAFE_ALBUM_AVATARS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_IMAGES=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_VIDEOS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_THUMBNAILS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_DOCUMENTS=CHANGE_ME_UUID
+CHIBISAFE_ALBUM_ARCHIVED=CHANGE_ME_UUID
+
+# ── CORS ──────────────────────────────────────────────────────────────────────
+ALLOWED_ORIGINS=http://localhost:5173,http://localhost:3024