# --- Django ---
DJANGO_SETTINGS_MODULE=config.settings.local
DJANGO_SECRET_KEY=changeme-local-only
DJANGO_DEBUG=True
DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
CORS_ALLOWED_ORIGINS=http://localhost:3000
# Production only: exact scheme+host of every origin allowed to POST/PUT/DELETE
# (e.g. https://roadfare.com) — required because the ALB fronts Django with HTTPS
# while the origin Django itself sees is HTTP; without this, CSRF checks reject
# every unsafe request from the real domain.
CSRF_TRUSTED_ORIGINS=

# --- Database (matches docker-compose db service) ---
POSTGRES_DB=roadfare
POSTGRES_USER=roadfare
POSTGRES_PASSWORD=roadfare
POSTGRES_HOST=db
POSTGRES_PORT=5432
DATABASE_URL=postgres://roadfare:roadfare@db:5432/roadfare

# --- Redis / Celery ---
REDIS_URL=redis://redis:6379/0
CELERY_BROKER_URL=redis://redis:6379/0
CELERY_RESULT_BACKEND=redis://redis:6379/1

# --- External data sources (apps/ingest) ---
NPS_API_KEY=
RIDB_API_KEY=
# Free key from https://www.eia.gov/opendata/register.php — weekly regional gasoline
# prices for apps.planner's fuel cost line (apps/ingest/clients/eia.py). No key means
# the fuel estimate falls back to the last cached value, or the bootstrap constant.
EIA_API_KEY=
GOOGLE_PLACES_API_KEY=
GOOGLE_ROUTES_API_KEY=
OSRM_BASE_URL=http://localhost:5001

# --- Third-party services ---
SENTRY_DSN=
RESEND_API_KEY=
POSTHOG_API_KEY=
ANTHROPIC_API_KEY=

# --- apps.core.revalidate -> frontend/src/app/api/revalidate — Django POSTs here
# whenever ingest/admin actions change published spot/content data, so the frontend
# can bust its page cache instead of waiting out a stale ISR window. FRONTEND_BASE_URL
# is where to send it; REVALIDATE_SECRET must be the same value set in the frontend's
# own env (it checks the header, Django sends it) — no default, since an empty shared
# secret would mean anyone could trigger revalidation.
FRONTEND_BASE_URL=http://localhost:3000
REVALIDATE_SECRET=

# --- Sign in with Google (apps.accounts) — get from
# https://console.cloud.google.com/apis/credentials (OAuth client ID, "Web application").
# No default; the Google sign-in button/endpoint stay inactive until this is set on
# both the backend and the frontend (same client ID in both places).
GOOGLE_OAUTH_CLIENT_ID=

# --- AWS (production only) ---
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_STORAGE_BUCKET_NAME=
AWS_S3_REGION_NAME=us-east-1
CLOUDFRONT_DOMAIN=

# --- Frontend (frontend/.env.local mirrors these) ---
NEXT_PUBLIC_SITE_URL=http://localhost:3000
NEXT_PUBLIC_API_BASE_URL=http://localhost:8000
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_MAPLIBRE_STYLE_URL=
NEXT_PUBLIC_GOOGLE_CLIENT_ID=