# Meerkat CRM - Docker Environment Configuration
# Copy this file to .env and update the values.
#
# NOTE: This file uses Docker env_file format (no 'export' prefix).
# For local development, use backend/.env.example instead.

# =============================================================================
# REQUIRED - You must set or consider these values
# =============================================================================

# Security - JWT secret key (minimum 32 characters)
JWT_SECRET_KEY=your-very-long-very-secret-jwt-key-change-this-in-production

# Frontend URL for CORS headers, to effectively disable CORS use "*"
# Use specific URL in production (e.g., https://crm.example.com)
FRONTEND_URL=*

# Email notifications can be delivered via Resend, SMTP, or both.
# If both are set, every email is sent through both channels. Leave a section empty to disable that or both channels.

# Resend (https://resend.com/)
RESEND_API_KEY=
RESEND_FROM_EMAIL=

# SMTP
# SMTP_HOST=smtp.example.com
# SMTP_PORT=587                 # default 587 (STARTTLS); use 465 with SMTP_USE_TLS=true
# SMTP_USERNAME=                # optional; leave empty for unauthenticated relay
# SMTP_PASSWORD=
# SMTP_FROM_EMAIL=
# SMTP_USE_TLS=false            # true = implicit TLS (port 465); false = plaintext/STARTTLS

# Enable the CardDav server for contact sync (default is false)
CARDDAV_ENABLED='true'

# =============================================================================
# DATA STORAGE PATHS
# =============================================================================

# Host paths for persistent data (relative or absolute), use this to declare the volumes on your server
DATA_PATH=./data
PHOTOS_PATH=./photos

# =============================================================================
# DOCKER IMAGE CONFIGURATION
# =============================================================================

# Image tag to pull (e.g., main, v1.0.0, sha-abc1234)
IMAGE_TAG=latest

# =============================================================================
# SINGLE SIGN-ON (OIDC) - Optional
# =============================================================================

# Set all three to enable SSO. The redirect URI is derived from FRONTEND_URL automatically.
# Register https://<your-domain>/api/v1/auth/oidc/callback as the redirect URI in your provider.
OIDC_PROVIDER_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=

# Automatically create an account on first SSO login (default: false)
# When false, the user must already have an account (matched by verified email or registered manually)
OIDC_AUTO_PROVISION=false

# Trust email claims from the OIDC provider without requiring email_verified=true (default: false)
# Enable this for self-hosted providers (e.g. Authentik) where you control user accounts.
# WARNING: Do not enable if using a public/untrusted OIDC provider — unverified email claims could allow account takeover of existing accounts.
OIDC_TRUST_EMAIL=false

# =============================================================================
# HOST PORT
# =============================================================================

# Host port the app is exposed on (default: 7300)
FRONTEND_PORT=7300

# =============================================================================
# OPTIONAL - These have sensible defaults
# =============================================================================

# JWT token expiry in hours
JWT_EXPIRY_HOURS=96

# Cookie Configuration
COOKIE_SECURE='false'
# Leave empty (recommended). Only set this if frontend and backend run on different subdomains
COOKIE_DOMAIN=

# Daily reminder notification time (HH:MM format, 24-hour)
REMINDER_TIME=06:00
# Timezone for reminder scheduling. Must be a valid IANA timezone name.
REMINDER_TIMEZONE=UTC

# HTTP Server Timeouts (in seconds)
HTTP_READ_TIMEOUT=15
HTTP_WRITE_TIMEOUT=15
HTTP_IDLE_TIMEOUT=60

# Logging
LOG_LEVEL=info
LOG_PRETTY=false

# Disable new user registration (default: false)
DISABLE_REGISTRATION=false

# Block webhook deliveries to private/internal IP ranges, relevant for cloud or multi-tenant setups to prevent SSRF attacks via outgoing webhooks
WEBHOOK_BLOCK_PRIVATE_URLS=false

# Calendar sync (CalDAV/ICS activity import), default every 6 hours
# Stored calendar passwords are encrypted with a key derived from JWT_SECRET_KEY;
# changing JWT_SECRET_KEY means calendar passwords must be re-entered.
CALDAV_SYNC_INTERVAL_HOURS=6
# Block calendar URLs resolving to private/loopback addresses, relevant for cloud or multi-tenant setups (prevent SSRF)
CALDAV_BLOCK_PRIVATE_URLS=false

# Monica import
# Block Monica URLs resolving to private/loopback addresses, relevant for cloud or multi-tenant setups (prevent SSRF)
MONICA_BLOCK_PRIVATE_URLS=false