# Database
# Optional override. Leave blank to auto-build from POSTGRES_* values.
DATABASE_URL=
POSTGRES_HOST=localhost
POSTGRES_PORT=6543
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=heym

# Credential encryption key (REQUIRED - generates a Fernet key for stored credentials)
# Generate a strong key: python -c "import secrets; print(secrets.token_hex(32))"
ENCRYPTION_KEY=change_this_to_a_random_32_byte_hex_value

# JWT Authentication
SECRET_KEY=your-super-secret-key-change-in-production-min-32-chars
JWT_ALGORITHM=HS256
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
JWT_REFRESH_TOKEN_EXPIRE_DAYS=7

# Backend
BACKEND_PORT=10105
ALLOW_REGISTER=true
TIMEZONE=Europe/Berlin

# Single-image runtime defaults
BACKEND_BIND_HOST=127.0.0.1
BACKEND_PROXY_HOST=127.0.0.1
AUTO_REWRITE_LOCAL_DATABASE_HOST=true

# Frontend
FRONTEND_PORT=4017
FRONTEND_URL=http://localhost:4017  # pragma: allowlist secret

# CORS (comma-separated origins)
CORS_ORIGINS=http://localhost:4017  # pragma: allowlist secret