# Environment

Configuration flows through Nuxt runtimeConfig (env vars). Never hard-code
production API URLs or expose private credentials.

## Variables

| Var | Default | Purpose |
|---|---|---|

| `NUXT_PUBLIC_API_BASE_URL` | `''` | Absolute backend origin for direct cross-origin calls; empty = same-origin `/api/...` via the proxy (recommended) |
| `NUXT_API_PROXY_TARGET` | `http://100.64.0.5:8080` | Where the `/api/**` Nitro proxy forwards (build/start time; not public runtime config) |

## Backend (`KeluargaMart`)

- Running on the VPS `100.64.0.5:8080` (Tailscale/CGNAT network; reachable
  only from within it — verified from this machine 2026-08-12).
- Probes (Phase 00 discovery): `/health` → `{"status":"ok"}`, `/ready` → 200;
  `POST /api/v1/auth/login` works with the seeded operator account.
- The `/docs` page references `/openapi.yaml`, but the running instance serves
  a 404 there — the spec is not exposed yet; the contract in
  `docs/AXIOS.md` was confirmed by live probes instead.
- The running instance does not emit CORS headers (checked for several
  origins). Keep using the Nuxt proxy; if you switch to direct calls, set the
  backend's `CORS_ORIGINS` to the exact frontend origin in `.env.prod` and
  verify with a preflight (`OPTIONS` + `Access-Control-Request-Method`).

## Frontend

- Dev server: `bun run dev` (Nuxt 4 / Nitro 2.13 / Vite 8). The `/api/**`
  proxy works in dev and production builds (Nitro route rule).
- There is no mock mode and no demo credential set in this repo. Buyer
  accounts come from the backend's own user table; use a real seeded account.
- Against a local backend, set `NUXT_API_PROXY_TARGET=http://localhost:8080`.