# Database Configuration
DATABASE_HOST=localhost
DATABASE_PORT=5432
DATABASE_REPLICA_HOSTS=replica-1.local,replica-2.local,replica-3.local
DATABASE_REPLICA_PORT=5432
DATABASE_USER=postgres
DATABASE_PASSWORD=postgres
DATABASE_NAME=teachlink
DATABASE_POOL_MAX=30
DATABASE_POOL_MIN=5
DATABASE_POOL_ACQUIRE_TIMEOUT_MS=10000
DATABASE_POOL_IDLE_TIMEOUT_MS=30000

# JWT Configuration
JWT_SECRET=your-super-secret-jwt-key-change-this-in-production-min-10-chars
ENCRYPTION_SECRET=your-super-secret-32-char-encryption-key-change-this
JWT_EXPIRES_IN=15m
JWT_REFRESH_SECRET=your-super-secret-refresh-key-change-this-in-production
JWT_REFRESH_EXPIRES_IN=7d

# Security Configuration
BCRYPT_ROUNDS=10

# Redis Configuration (for Bull Queue)
REDIS_HOST=localhost
REDIS_PORT=6379

# Elasticsearch / Log Aggregation
# Node URL for the Elasticsearch cluster used for centralised log storage.
# Leave unset to disable log shipping (app still logs to stdout).
ELASTICSEARCH_NODE=http://localhost:9200
# Optional basic-auth credentials (mutually exclusive with ELASTICSEARCH_API_KEY)
ELASTICSEARCH_USERNAME=
ELASTICSEARCH_PASSWORD=
# Optional API-key auth (preferred for cloud-hosted clusters)
ELASTICSEARCH_API_KEY=
# Optional CA fingerprint for TLS verification in self-signed setups
ELASTICSEARCH_CA_FINGERPRINT=
ELASTICSEARCH_REQUEST_TIMEOUT=30000
ELASTICSEARCH_MAX_RETRIES=3
# Kibana URL used for log-search dashboards
KIBANA_URL=http://localhost:5601

# Alerting / Notification Channels
# Comma-separated list of email addresses that receive alert notifications
ALERT_EMAIL_RECIPIENTS=ops@teachlink.io,oncall@teachlink.io
# Slack incoming webhook URL for alert notifications (leave blank to disable)
ALERT_SLACK_WEBHOOK_URL=https://hooks.slack.com/services/YOUR/SLACK/WEBHOOK

# Email Marketing - SMTP Configuration
SMTP_HOST=smtp.mailtrap.io
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=your_smtp_user
SMTP_PASS=your_smtp_password
EMAIL_FROM=noreply@teachlink.io
EMAIL_FROM_NAME=TeachLink

# SendGrid Configuration (Email Service)
SENDGRID_API_KEY=your_sendgrid_api_key
SENDGRID_HEALTH_URL=https://api.sendgrid.com/v3/health

# Stripe Configuration (Payment Processing)
STRIPE_SECRET_KEY=your_stripe_secret_key
STRIPE_WEBHOOK_SECRET=your_stripe_webhook_secret
STRIPE_HEALTH_URL=https://api.stripe.com/v1/balance

# AWS Configuration (S3, CloudFront, KMS)
AWS_ACCESS_KEY_ID=your_aws_access_key
AWS_SECRET_ACCESS_KEY=your_aws_secret_key
AWS_REGION=us-east-1
AWS_S3_BUCKET=your-s3-bucket-name
AWS_S3_BUCKET_NAME=your-s3-bucket-name
AWS_KMS_KEY_ID=your-kms-key-id
AWS_CLOUDFRONT_DISTRIBUTION_ID=your-cloudfront-distribution-id
AWS_HEALTH_URL=https://sts.amazonaws.com

# Session Configuration
SESSION_SECRET=your-session-secret-min-10-chars
SESSION_COOKIE_NAME=teachlink.sid
SESSION_PREFIX=sess:
SESSION_TTL_SECONDS=604800
SESSION_COOKIE_MAX_AGE_MS=604800000
SESSION_LOCK_TTL_MS=5000
SESSION_LOCK_MAX_RETRIES=5
SESSION_LOCK_RETRY_DELAY_MS=120
STICKY_SESSIONS_REQUIRED=true
TRUST_PROXY=true

# Application URL (for tracking links)
APP_URL=http://localhost:3000

# CORS Configuration (comma-separated list of allowed origins)
CORS_ALLOWED_ORIGINS=http://localhost:3000,http://localhost:4000

# GraphQL Complexity Analysis
GRAPHQL_MAX_DEPTH=10
GRAPHQL_MAX_COMPLEXITY=1000
GRAPHQL_LIST_MULTIPLIER=10

# =============================================================================
# Feature Flags - Module Loading Configuration
# =============================================================================
# Set to 'false' to disable loading of specific modules at startup
# This reduces memory footprint and improves startup time
# =============================================================================

# Core Features (recommended to keep enabled)
ENABLE_AUTH=true
ENABLE_SESSION_MANAGEMENT=true

# Optional Feature Modules
ENABLE_PAYMENTS=true
ENABLE_AB_TESTING=false
ENABLE_DATA_WAREHOUSE=false
ENABLE_COLLABORATION=true
ENABLE_MEDIA_PROCESSING=true
ENABLE_BACKUP=true
ENABLE_GRAPHQL=false
ENABLE_SYNC=true
ENABLE_MIGRATIONS=true
ENABLE_RATE_LIMITING=true
ENABLE_OBSERVABILITY=true
ENABLE_CACHING=true
ENABLE_FEATURE_FLAGS=true
ENABLE_SEARCH=true
ENABLE_NOTIFICATIONS=true
ENABLE_EMAIL_MARKETING=true
ENABLE_GAMIFICATION=true
ENABLE_ASSESSMENT=true
ENABLE_LEARNING_PATHS=true
ENABLE_MODERATION=true
ENABLE_ORCHESTRATION=true
ENABLE_SECURITY=true
ENABLE_TENANCY=true
ENABLE_CDN=true

# Performance Tuning
# Set to 'true' to enable cluster mode (uses all CPU cores)
CLUSTER_MODE=false
CLUSTER_WORKERS=4

# =============================================================================
# Secrets Management Configuration
# =============================================================================
# Secret provider: 'env' (default), 'aws' (AWS Secrets Manager), or 'vault' (HashiCorp Vault)
SECRET_PROVIDER=env

# AWS Secrets Manager Configuration (when SECRET_PROVIDER=aws)
SECRET_CACHE_TTL_MS=300000
SECRETS_TO_ROTATE=JWT_SECRET,DATABASE_PASSWORD,STRIPE_SECRET_KEY

# HashiCorp Vault Configuration (when SECRET_PROVIDER=vault)
VAULT_ADDR=https://vault.example.com:8200
VAULT_TOKEN=your-vault-token
VAULT_SECRET_PATH=secret/data

# =============================================================================
# Idempotency Configuration
# =============================================================================
# TTL for idempotency keys in seconds (default: 86400 = 24 hours)
IDEMPOTENCY_TTL_SECONDS=86400

# =============================================================================
# Circuit Breaker Configuration
# =============================================================================
# Timeout in ms before considering a call failed
CIRCUIT_BREAKER_TIMEOUT_MS=3000
# Error percentage threshold to open circuit (1-100)
CIRCUIT_BREAKER_ERROR_THRESHOLD=50
# Time in ms to wait before attempting to close circuit
CIRCUIT_BREAKER_RESET_TIMEOUT_MS=30000
# Rolling window for tracking stats in ms
CIRCUIT_BREAKER_ROLLING_COUNT_TIMEOUT=60000
# Number of stat buckets for rolling window
CIRCUIT_BREAKER_ROLLING_COUNT_BUCKETS=10