# --- App ---
# REQUIRED: a random secret >=32 chars. The app refuses to start with a weak/default
# one. Generate: python -c "import secrets;print(secrets.token_urlsafe(48))"
APP_SECRET_KEY=
# Dev/test only: set true to bypass the weak-secret guard. NEVER in production.
ALLOW_INSECURE_SECRET=false
DATABASE_PATH=/data/app.db
TZ=Europe/Rome
DEFAULT_LOCALE=it
# Set to your https:// URL in production so session cookies get the Secure flag.
PUBLIC_BASE_URL=http://localhost:8000

# --- SuperAdmin (seeded on first boot) ---
SUPERADMIN_USERNAME=admin
# Leave blank/default and a random password is generated + logged once at first
# boot (then change it from /profile). Set explicitly to choose your own.
SUPERADMIN_PASSWORD=

# --- Plex (admin token used for invites + OAuth) ---
PLEX_TOKEN=
PLEX_SERVER_NAME=
# Optional: stable Plex client identifier. Derived from APP_SECRET_KEY if blank.
PLEX_CLIENT_ID=
# Revoke Plex access when a user is deleted (default off).
PLEX_REVOKE_ON_DELETE=false
# Optional: connect straight to this Plex baseurl, skipping plex.tv discovery
# (kills the ~8s LAN-probe timeout when the host can't reach Plex's LAN IPs).
# Use the plex.direct dashed-host form so the wildcard TLS cert validates:
#   https://<dashed-ip>.<servercerthash>.plex.direct:<port>
# Leave blank to use normal discovery.
PLEX_DIRECT_URL=

# --- Reverse proxy ---
# uvicorn trusts X-Forwarded-* only from these source IPs. Set to your proxy's
# IP/subnet (e.g. 172.18.0.0/16). Do NOT use "*" on a directly-exposed app.
FORWARDED_ALLOW_IPS=127.0.0.1

# --- Telegram bot ---
TELEGRAM_BOT_TOKEN=
TELEGRAM_BOT_USERNAME=

# --- SMTP (notification email) ---
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=
SMTP_FROM_NAME=
SMTP_TLS=true

# --- Scheduler ---
NOTIFY_HOUR=9
# Reminder/dunning schedule (admin-editable in Settings; these are the defaults).
# Comma-separated days. before = days remaining; after = overdue days (0 = expiry day).
REMINDER_DAYS_BEFORE=7,3,1
REMINDER_DAYS_AFTER=0,3
# Manager weekly-collect-digest lookahead window in days (admin-editable in Settings).
DIGEST_LOOKAHEAD_DAYS=14