# Copy this file to .env.
# Docker deployment:
#   cp .env.example .env
#   scripts/bootstrap-env.sh .env

# ==================================================
# User-Configured Values (set these first)
# ==================================================

# Required: Public backend base URL users/browsers can reach.
# Used for callback URL generation and API origin checks.
# Example: http://localhost:3000
APP_BASE_URL=http://localhost:3000

# Required: Public frontend URL users open in browser.
# Example: http://localhost:7676
FRONTEND_BASE_URL=http://localhost:7676

# Required: OIDC issuer URL from your external identity provider.
# Must match the issuer claim in tokens.
# Example: https://auth.example.com/realms/simplemail
OIDC_ISSUER_URL=

# Required: OIDC client id configured in your provider.
# Example: simplemail-web
OIDC_CLIENT_ID=simplemail-web

# Optional: Direct JWKS URL for backend token verification.
# Set this when OIDC_ISSUER_URL is browser-reachable but not container-reachable.
# Example: http://keycloak:8080/realms/simplemail/protocol/openid-connect/certs
OIDC_JWKS_URI=

# Optional: Allow HTTP (non-HTTPS) OIDC endpoints for local/private networks.
# true only for local/self-hosted non-TLS setups.
# Example: true
OIDC_ALLOW_INSECURE_HTTP=false

# Required: Exactly one allowed user email (single-user mode).
# Leave blank here and set it in your real .env.
# Example: you@example.com
OIDC_ALLOWED_EMAILS=

# Optional: Restrict login to one exact subject claim.
# Usually leave blank.
# Example: 2c9d9e44-...-8f11
OIDC_REQUIRED_SUBJECT=

# Optional: Allowed JWT signature algorithms.
# Comma-separated.
# Example: RS256
OIDC_ALLOWED_ALGS=RS256

# Optional: Require OIDC email_verified=true.
# Example: true
OIDC_REQUIRE_EMAIL_VERIFIED=false

# Required: Frontend OIDC issuer URL (browser-reachable).
# Usually same as OIDC_ISSUER_URL.
# Example: https://auth.example.com/realms/simplemail
VITE_OIDC_ISSUER_URL=

# Required: Frontend OIDC client id.
# Usually same as OIDC_CLIENT_ID.
# Example: simplemail-web
VITE_OIDC_CLIENT_ID=simplemail-web

# Optional: OIDC scopes requested by frontend.
# Include offline_access to receive refresh tokens and avoid frequent re-login.
# Example: openid profile email offline_access
VITE_OIDC_SCOPES=openid profile email

# Optional: Google OAuth client id (only if using Google connector flow).
# Example: 1234567890-abc.apps.googleusercontent.com
GOOGLE_CLIENT_ID=

# Optional: Google OAuth client secret.
# Example: GOCSPX-xxxxxxxxxxxxxxxx
GOOGLE_CLIENT_SECRET=

# Optional: Google OAuth callback URL.
# Usually backend callback path on APP_BASE_URL.
# Example: http://localhost:3000/api/oauth/google/callback
GOOGLE_REDIRECT_URI=http://localhost:3000/api/oauth/google/callback

# Optional: Enable Gmail Pub/Sub push sync.
# Set true only when topic/webhook/service account are configured.
# Example: false
GMAIL_PUSH_ENABLED=false

# Optional: Full Pub/Sub topic resource name.
# Example: projects/my-project/topics/simplemail-gmail-sync
GMAIL_PUSH_TOPIC_NAME=

# Optional: API webhook path for Pub/Sub push requests.
# Example: /api/gmail/push
GMAIL_PUSH_WEBHOOK_PATH=/api/gmail/push

# Optional: Expected OIDC audience for Pub/Sub push auth token.
# Example: https://api.example.com/api/gmail/push
GMAIL_PUSH_WEBHOOK_AUDIENCE=

# Optional: Service account email expected in Pub/Sub push token.
# Example: pubsub-push@my-project.iam.gserviceaccount.com
GMAIL_PUSH_SERVICE_ACCOUNT_EMAIL=

# Optional: Image tag/version to deploy.
# Example: latest or 0.1.5
SIMPLEMAIL_VERSION=latest

# Optional: Backend image repository.
# Example: docker.io/zimengxiong/simplemail-backend
SIMPLEMAIL_BACKEND_REPOSITORY=docker.io/zimengxiong/simplemail-backend

# Optional: Client image repository.
# Example: docker.io/zimengxiong/simplemail-client
SIMPLEMAIL_CLIENT_REPOSITORY=docker.io/zimengxiong/simplemail-client

# ==================================================
# Bootstrapped / Internal Values (usually do not edit manually)
# ==================================================
# scripts/bootstrap-env.sh generates/normalizes these for docker deployment.

# Internal: Backend DB connection string used by containers.
# Auto-normalized by bootstrap.
DATABASE_URL=postgres://simplemail:simplemail@localhost:5432/simplemail

# Internal: Postgres database name.
POSTGRES_DB=simplemail

# Internal: Postgres username.
POSTGRES_USER=simplemail

# Internal: Postgres password (bootstrap generates secure value).
POSTGRES_PASSWORD=simplemail

# Internal: Admin API token (bootstrap generates secure value).
API_ADMIN_TOKEN=

# Internal: API listen port inside container.
PORT=3000

# Internal: Runtime mode.
# production for deployed stack, development for local dev workflows.
NODE_ENV=development

# Internal: OAuth callback route path.
OAUTH_CALLBACK_PATH=/oauth/callback

# Internal: Allow /api/admin bootstrap routes without full setup.
ALLOW_ADMIN_USER_BOOTSTRAP=false

# Internal: Seaweed S3 endpoint.
# Bootstrap rewrites localhost to docker service address.
SEAWEED_S3_ENDPOINT=http://localhost:8333

# Internal: Seaweed region.
SEAWEED_REGION=us-east-1

# Internal: Seaweed bucket name.
SEAWEED_BUCKET=simplemail

# Internal: Seaweed access key (bootstrap generates if blank).
SEAWEED_ACCESS_KEY_ID=

# Internal: Seaweed secret key (bootstrap generates if blank).
SEAWEED_SECRET_ACCESS_KEY=

# Internal: Seaweed path-style S3 addressing.
SEAWEED_FORCE_PATH_STYLE=true

# Internal tuning: IMAP/Gmail sync behavior.
SYNC_USE_IDLE=true
IDLE_POLL_INTERVAL_MS=15000
DEFAULT_MAILBOX=INBOX
SYNC_FLAG_SYNC_WINDOW=256
SYNC_OPERATION_TIMEOUT_MS=120000
SYNC_FULL_RECONCILE_INTERVAL_MS=86400000
SYNC_RECENT_RECONCILE_UID_WINDOW=2000
SYNC_SOURCE_FETCH_BATCH_SIZE=200
SYNC_SYNC_CLAIM_STALE_MS=180000
SYNC_SYNC_CLAIM_HEARTBEAT_STALE_MS=45000
GMAIL_SYNC_CONCURRENCY=4
GMAIL_BOOTSTRAP_METADATA_ONLY=true
GMAIL_BOOTSTRAP_CONCURRENCY=10
GMAIL_BACKGROUND_HYDRATE_BATCH_SIZE=200
GMAIL_BACKGROUND_HYDRATE_CONCURRENCY=4
SYNC_EVENTS_RETENTION_DAYS=14
SYNC_EVENTS_PRUNE_BATCH_SIZE=2000
SYNC_EVENTS_PRUNE_MAX_BATCHES=3
SYNC_EVENTS_PRUNE_INTERVAL_MS=300000

# Optional security/scanning features.
CLAMAV_ENABLED=false
CLAMAV_HOST=clamd
CLAMAV_PORT=3310
CLAMAV_TIMEOUT_MS=15000
CLAMAV_ATTACHMENT_MAX_BYTES=20971520
CLAMAV_SCAN_ON_INGEST=true

# Optional web push notifications.
WEB_PUSH_ENABLED=false
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_EMAIL=mailto:admin@example.com

# Optional transport/network safety toggles.
ALLOW_INSECURE_MAIL_TRANSPORT=false
ALLOW_PRIVATE_NETWORK_TARGETS=false