backend barebone done, big chunk of work done

server/internal/platform/config/config.go

@@ -20,6 +20,10 @@ type Config struct {
 	// AllowedOrigins is a comma-separated list of CORS origins
 	// allowed to call the API from a browser.
 	AllowedOrigins []string
+	// DatabaseURL is the PostgreSQL DSN.
+	DatabaseURL string
+	// JWTSecret signs access tokens. Must be set in production.
+	JWTSecret string
 }
 
 // Load reads configuration from the environment, falling back to
@@ -29,6 +33,8 @@ func Load() (*Config, error) {
 		HTTPAddr:    fromEnv("MESSENGER_HTTP_ADDR", ":8080"),
 		StaticDir:   os.Getenv("MESSENGER_STATIC_DIR"),
 		Environment: fromEnv("MESSENGER_ENV", "development"),
+		DatabaseURL: fromEnv("MESSENGER_DATABASE_URL", "postgres://messenger:messenger@localhost:5432/messenger?sslmode=disable"),
+		JWTSecret:   fromEnv("MESSENGER_JWT_SECRET", "dev-secret-change-me"),
 	}
 
 	for _, origin := range strings.Split(fromEnv("MESSENGER_ALLOWED_ORIGINS", ""), ",") {
@@ -43,6 +49,10 @@ func Load() (*Config, error) {
 		return nil, fmt.Errorf("MESSENGER_ENV must be one of development|staging|production, got %q", cfg.Environment)
 	}
 
+	if cfg.Environment == "production" && cfg.JWTSecret == "dev-secret-change-me" {
+		return nil, fmt.Errorf("MESSENGER_JWT_SECRET must be set in production")
+	}
+
 	return cfg, nil
 }