# ============================================================
# ERP stack configuration — copy to .env and fill in real values.
# .env is git-ignored; NEVER commit real credentials.
#   Local dev:      cp .env.example .env   (defaults work as-is)
#   Production VPS: /srv/erp/.env with STRONG values for every entry —
#                   docker-compose.prod.yml refuses to boot without them.
# ============================================================

# --- Public hosts (production; local defaults live in docker-compose.yml) ---
APP_HOST=aramesh.bennu-api-bahrestan.ir
API_HOST=api.bennu-api-bahrestan.ir
AUTH_HOST=casdoor.bennu-api-bahrestan.ir
S3_HOST=s3.bennu-api-bahrestan.ir
STORAGE_HOST=storage.bennu-api-bahrestan.ir

# --- Traefik / Let's Encrypt ---
TRAEFIK_ACME_EMAIL=you@example.com

# --- Environment: "prod" enables the fail-fast startup checks in the API ---
ENVIRONMENT=prod

# --- PostgreSQL (app + Casdoor share the instance) ---
POSTGRES_PASSWORD=CHANGE_ME_strong_db_password

# --- MinIO object storage root credentials ---
MINIO_ROOT_USER=CHANGE_ME_minio_user
MINIO_ROOT_PASSWORD=CHANGE_ME_long_random_minio_password

# --- Casdoor OIDC application (must match the Casdoor application record) ---
CASDOOR_CLIENT_SECRET=CHANGE_ME_casdoor_client_secret
CASDOOR_ADMIN_PASSWORD=CHANGE_ME_casdoor_console_admin_password

# --- CORS: exact browser origins allowed to call the API (comma-separated) ---
CORS_ORIGINS=https://aramesh.bennu-api-bahrestan.ir

# --- Developer Mode (X-User-* header identity + login panel) ---
# MUST stay false in production. Only for local debugging without tokens.
DEV_LOGIN_ENABLED=false

# --- Deploy webhook (Gitea push → rebuild; see infra/deploy-webhook/) ---
GITEA_WEBHOOK_SECRET=CHANGE_ME_long_random_webhook_secret

# --- Backups (db-backup sidecar; see docker-compose.yml) ---
BACKUP_DIR=/srv/erp/backups
BACKUP_INTERVAL_SECONDS=86400
BACKUP_KEEP_DAYS=14

# --- Monitoring stack (see monitoring/README.md) ---
# API log format for Loki ingestion ("text" locally, "json" in production)
LOG_FORMAT=json
# GlitchTip (error tracking). GLITCHTIP_HOST must be a public DNS name —
# the browser SDK posts errors there.
GLITCHTIP_SECRET_KEY=CHANGE_ME_random_django_secret
GLITCHTIP_DOMAIN=https://errors.bennu-api-bahrestan.ir
GLITCHTIP_HOST=errors.bennu-api-bahrestan.ir
GLITCHTIP_DB_PASSWORD=CHANGE_ME_glitchtip_db_password
GLITCHTIP_FROM_EMAIL=noreply@bennu-api-bahrestan.ir
GLITCHTIP_EMAIL_URL=consolemail://
# Grafana (dashboards) — UI is loopback-only (:3001) unless you add Traefik labels
GRAFANA_ADMIN_PASSWORD=CHANGE_ME_grafana_password
GRAFANA_ROOT_URL=http://localhost:3001/
# OpenPanel (product analytics) — client id/secret from the OpenPanel project
OPENPANEL_API_URL=http://openpanel-api:3333
OPENPANEL_CLIENT_ID=
OPENPANEL_CLIENT_SECRET=
# Public origin of the OpenPanel dashboard/API the BROWSER talks to
# (e.g. https://stats.bennu-api-bahrestan.ir — see monitoring/README.md)
OPENPANEL_PUBLIC_URL=
# Sentry/GlitchTip DSNs created in the GlitchTip UI after first boot
SENTRY_DSN_BACKEND=
SENTRY_DSN_FRONTEND=