# App Tracker - minimum configuration.
# Copy this file to .env and fill in your values. Never commit .env.
#
# For the full reference including branding and rate-limit tuning, see
# .env.example.

# -- Required secrets ---------------------------------------------------------
# Generate each with:  openssl rand -hex 32
FLASK_SECRET_KEY=change-me-to-a-long-random-string
ADMIN_JWT_SECRET=change-me-to-a-long-random-string

# Admin panel password (seeded on first boot for the "admin" user)
ADMIN_PASSWORD=change-me-to-a-secure-password

# Public HTTPS origin used in email links (no trailing slash)
SITE_URL=https://yourdomain.com

# -- Microsoft 365 Graph email (optional - choose M365 OR Resend) ------------
# Entra App Registration with Mail.Send application permission.
# M365_CLIENT_ID=your-client-id-here
# M365_CLIENT_SECRET=your-client-secret-here
# M365_TENANT_ID=common
# SENDER_EMAIL=your-sender@example.com

# -- Resend email (optional alternative to M365) -----------------------------
# Sign up at https://resend.com and verify your sending domain.
# RESEND_API_KEY=re_xxxxxxxxxx
# RESEND_FROM_EMAIL=notifications@yourdomain.com

# Comma-separated default recipients for admin/test emails
# NOTIFICATION_RECIPIENTS=you@example.com

# -- Optional extras ----------------------------------------------------------
# QWA_SITE=yourdomain.com
# QWA_SCRIPT_URL=https://analytics.example.com/t.js
# CONTACT_EMAIL=support@example.com

# Override Graph API endpoints (usually not needed)
# GRAPH_API_URL=https://graph.microsoft.com/v1.0
# TOKEN_URL=https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token