# ==============================================================================
# AutoLedger Environment Configuration
# ==============================================================================

# Server configuration
AUTOLEDGER_PORT=8080
AUTOLEDGER_BASE_URL=http://localhost:8080
# ENVIRONMENT=production switches logs to JSON and defaults the log level to INFO
# (never DEBUG), enables Secure cookies, and activates the insecure-defaults warning.
# Set to "development" only for local work (make dev).
ENVIRONMENT=production
# LOG_LEVEL overrides the default for either mode: DEBUG, INFO, WARN or ERROR.
# LOG_LEVEL=INFO

# AUTOLEDGER_VERSION: pin a specific release tag (e.g. v1.17.0) for reproducible deployments.
# Defaults to "latest" for quick testing. (Legacy TESLACOST_VERSION is also supported).
AUTOLEDGER_VERSION=latest

# Database configuration (PostgreSQL)
# Recommended: Use granular DB_* variables (handles special characters in password automatically):
AUTOLEDGER_DB_HOST=postgres
AUTOLEDGER_DB_PORT=5432
AUTOLEDGER_DB_USER=autoledger
# Leave unset: a random password is generated on first start and kept in the autoledger_secrets volume.
# Setting it forces that value (and must match an existing database volume when upgrading).
# AUTOLEDGER_DB_PASSWORD=
AUTOLEDGER_DB_NAME=autoledger
DB_SSLMODE=disable
# DB_PORT_BIND: host bind address:port for the postgres container (127.0.0.1 only by default).
# Set to 0.0.0.0:5432 (or similar) only if you need to reach Postgres from outside this host.
DB_PORT_BIND=127.0.0.1:5432

# Alternative: Full connection string (note: special characters in password must be percent-encoded if used)
# AUTOLEDGER_DATABASE_URL=postgres://autoledger:autoledger_dev_secret@localhost:5432/autoledger?sslmode=disable

# Security & Secrets
# AUTOLEDGER_ENCRYPTION_KEY (or APP_ENCRYPTION_KEY): Secret the key protecting the stored credentials is derived from (AES-256-GCM, key derived with Argon2id)
# Leave unset to have a random value generated on first start and kept on the storage volume. To set your own, use a random
# value of at least 32 characters (openssl rand -hex 32). Changing it later makes the stored credentials unreadable until
# they are entered again.
# AUTOLEDGER_ENCRYPTION_KEY=
# AUTOLEDGER_JWT_SECRET (or JWT_SECRET): Secret key for signing user authentication tokens
# AUTOLEDGER_JWT_SECRET=
# Access tokens are short lived and renewed with a rotating refresh token.
# JWT_ACCESS_EXPIRATION_MINUTES=15
# JWT_REFRESH_EXPIRATION_DAYS=30

# With ENVIRONMENT=production the server refuses to start while JWT_SECRET, AUTOLEDGER_ENCRYPTION_KEY or DB_PASSWORD
# hold a default value published in this repository. All three are generated on first start when unset.

# Reverse proxy. Forwarding headers (X-Forwarded-For / -Proto) are only believed when the connection comes from
# one of these addresses; the default is loopback plus the private ranges (Docker networks, LAN).
# A proxy on a public address must be listed. "none" trusts no proxy.
# TRUSTED_PROXIES=127.0.0.1,172.16.0.0/12
# Security headers (CSP, X-Frame-Options, HSTS over HTTPS...) are sent by the application. Turn them off if your
# proxy already sets them, or loosen the policy with CONTENT_SECURITY_POLICY ("off" removes only the CSP).
# SECURITY_HEADERS=true
# CONTENT_SECURITY_POLICY=

# Reverse geocoding of the positions sent by integrations (Home Assistant trips), through OpenStreetMap Nominatim.
# Off by default: the coordinates are sent to the geocoding service. Point GEOCODING_URL at a self-hosted Nominatim
# to keep them local.
# GEOCODING_ENABLED=false
# GEOCODING_URL=
# GEOCODING_USER_AGENT=

# User Registration & Initial Admin Setup
# DISABLE_REGISTRATION: set to true to close the local sign-up form. SSO accounts are not covered: an identity that
# the provider vouches for (and OIDC_ALLOWED_EMAILS admits) still gets an account, so restrict who may sign in there.
DISABLE_REGISTRATION=false

# Public read-only demo: refuses every write except sign-in. Seed it with `go run ./cmd/demoseed` against a
# non-demo instance first, then restart with AUTOLEDGER_DEMO=true. The email/password pair is shown on the sign-in page.
# AUTOLEDGER_DEMO=true
# AUTOLEDGER_DEMO_EMAIL=demo@autoledger.example
# AUTOLEDGER_DEMO_PASSWORD=

# Let an assistant (Claude, Cursor, any MCP client) read the costs of your vehicles, read-only, through <AUTOLEDGER_BASE_URL>/mcp.
# AUTOLEDGER_BASE_URL must be the public https address. See docs/mcp.md.
# AUTOLEDGER_MCP_ENABLED=true
# Serve the OAuth authorization pages alone (Home Assistant connects through them), without the MCP endpoint.
# AUTOLEDGER_BASE_URL must be the public address. See docs/oauth.md.
# AUTOLEDGER_OAUTH_ENABLED=true

# Optional: Auto-create initial admin account on first startup (especially useful if DISABLE_REGISTRATION=true)
# INITIAL_ADMIN_EMAIL=admin@your-domain.com
# INITIAL_ADMIN_PASSWORD=YourSecurePassword123!

# Reporting timezone (IANA name) used to group costs by month
APP_TIMEZONE=Europe/Paris

# CORS: leave unset. The embedded frontend is same-origin as the API, so the origin of
# AUTOLEDGER_BASE_URL is allowed automatically (plus the local dev servers outside production).
# Only set this (comma-separated) to allow a frontend served from another origin.
# CORS_ALLOWED_ORIGINS=https://other-frontend.example.com

# Document File Storage Directory (mounted volume)
AUTOLEDGER_STORAGE_DIR=/data/documents

# Automated backups (postgres dump + documents archive), stored in the
# autoledger_backups volume. Copy them off-host regularly (Proxmox backup job,
# rsync, ...): a named volume alone does not protect against disk/host loss.
BACKUP_INTERVAL_HOURS=24
BACKUP_RETENTION_DAYS=14

# --- Migration from TeslaCost (Optional) ---
# If you are upgrading an existing TeslaCost deployment without moving data:
# DB_VOLUME_NAME=postgres_data
# DOCUMENTS_VOLUME_NAME=teslacost_documents
# BACKUPS_VOLUME_NAME=teslacost_backups
# AUTOLEDGER_DB_USER=teslacost
# AUTOLEDGER_DB_PASSWORD=teslacost_dev_secret
# AUTOLEDGER_DB_NAME=teslacost

# --- OIDC / SSO (Optional) ---
# Leave OIDC_ISSUER_URL empty to use local email/password authentication only.
# OIDC_ISSUER_URL=https://auth.homelab.local/application/o/autoledger/
# OIDC_CLIENT_ID=autoledger
# OIDC_CLIENT_SECRET=
# OIDC_REDIRECT_URL=https://autoledger.homelab.local/api/auth/oidc/callback
# OIDC_PROVIDER_NAME=Authentik
# OIDC_SCOPES=openid email profile
# OIDC_ALLOWED_EMAILS=
# OIDC_DISABLE_LOCAL_AUTH=false