# ─── Pentest Companion — Environment Variables ─────────────────────────────────
# Copy to `.env` and customise. Never commit your real .env to git.

# REQUIRED: 64-char hex secret. Generate with: python -c "import secrets;print(secrets.token_hex(32))"
SECRET_KEY=

# Public URL of your instance (no trailing slash). Used to build outbound links in emails
# (password reset, invitations). Falls back to request.host_url when not set, which works
# for local dev but breaks behind a reverse proxy.
APP_BASE_URL=https://app.yourdomain.com

# REQUIRED on first run: password for the bootstrapped admin account
ADMIN_PASSWORD=changeme
ADMIN_EMAIL=admin@example.com

# Allow self-service account creation (set to 0 for invite-only deployments)
ALLOW_REGISTRATION=1

# Force the session cookie to require HTTPS and add HSTS header. Set to 1 in production.
FORCE_HTTPS=0

# Max upload size in megabytes (evidence files)
MAX_UPLOAD_MB=25

# Database path inside the container (Docker maps this to a named volume)
DATABASE_PATH=/data/pentest.db
UPLOAD_FOLDER=/data/uploads

# Host port to expose Docker on (default 5000)
HOST_PORT=5000

# ─── Email (required for password reset and welcome emails in production) ──────
# Without any email config, reset links are only printed to the server log (dev mode).
#
# Option 1 — Resend (recommended, simpler setup):
#   Sign up at resend.com, verify your domain, create an API key.
RESEND_API_KEY=re_...
SMTP_FROM=Pentest Companion <noreply@yourdomain.com>
#
# Option 2 — Generic SMTP (SendGrid, Mailgun, your own server, etc.):
# SMTP_HOST=smtp.sendgrid.net
# SMTP_PORT=587
# SMTP_USER=apikey
# SMTP_PASS=SG.xxx
# SMTP_FROM=Pentest Companion <noreply@yourdomain.com>
# SMTP_TLS=1

# ─── TerminatorZ integration ──────────────────────────────────────────────────
# Absolute path to the TerminatorZ directory (where terminatorz.sh lives).
# Clone with: git clone https://github.com/blackhatethicalhacking/TerminatorZ /opt/TerminatorZ
# Then: chmod +x /opt/TerminatorZ/terminatorz.sh /opt/TerminatorZ/modules/*.sh
# Required dependencies on PATH: subfinder, waybackurls, httpx, curl, bash 4+
TERMINATORZ_DIR=/opt/TerminatorZ
# Optional: writable directory for scan results (symlinked to TerminatorZ's ./results/).
# Set this if the web app user cannot write inside TERMINATORZ_DIR (e.g. /opt is root-owned).
# TERMINATORZ_RESULTS_DIR=/home/user/.terminatorz-results

# ─── Rate limiter storage (production) ────────────────────────────────────────
# memory:// is the default but is per-process — with multiple gunicorn workers
# each worker has an independent counter. Use Redis for accurate limits.
# RATELIMIT_STORAGE_URI=redis://localhost:6379/0