# =============================================================================
# DevOps Portal v2 - Environment Configuration
# =============================================================================

# -----------------------------------------------------------------------------
# Application
# -----------------------------------------------------------------------------
NODE_ENV=development
NEXT_PUBLIC_APP_URL=http://localhost:3000

# -----------------------------------------------------------------------------
# Authentication (NextAuth.js)
# -----------------------------------------------------------------------------
# Generate with: openssl rand -base64 32
NEXTAUTH_SECRET=your-secret-here
NEXTAUTH_URL=http://localhost:3000

# Enable credentials-based login (email/password)
# Set to true for development/demo, false for production SSO-only
ENABLE_CREDENTIALS_AUTH=true

# Bcrypt rounds for password hashing (10-14 recommended)
BCRYPT_ROUNDS=12

# Keycloak OIDC Provider (optional)
KEYCLOAK_ID=devops-portal
KEYCLOAK_SECRET=your-keycloak-secret
KEYCLOAK_ISSUER=https://keycloak.example.com/realms/devops

# GitHub OAuth (optional - for GitHub login)
GITHUB_CLIENT_ID=your-github-client-id
GITHUB_CLIENT_SECRET=your-github-client-secret

# Optional: Restrict GitHub OAuth to members of a specific GitHub organization
# Users not in this org will be denied sign-in via GitHub
# GITHUB_ALLOWED_ORG=your-github-org

# Auto-provisioning: Add new OAuth users to a default organization
# Slug of the default org (created by db:seed). Set to "" to disable.
DEFAULT_ORG_SLUG=default
# Role assigned to auto-provisioned users: USER, READWRITE, or ADMIN
DEFAULT_ORG_ROLE=USER

# -----------------------------------------------------------------------------
# Database (PostgreSQL)
# -----------------------------------------------------------------------------
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/devops_portal?schema=public

# -----------------------------------------------------------------------------
# Redis (Sessions, Rate Limiting, BullMQ)
# -----------------------------------------------------------------------------
REDIS_URL=redis://localhost:6379

# Token encryption key for GitHub tokens (generate with: openssl rand -base64 32)
# Supports key rotation: TOKEN_ENCRYPTION_KEY_2, TOKEN_ENCRYPTION_KEY_3, etc.
TOKEN_ENCRYPTION_KEY=your-base64-key-here

# -----------------------------------------------------------------------------
# S3 / MinIO Object Storage
# -----------------------------------------------------------------------------
# For MinIO (local development)
S3_ENDPOINT=http://localhost:9000
S3_PATH_STYLE=true
AWS_ACCESS_KEY_ID=minioadmin
AWS_SECRET_ACCESS_KEY=minioadmin
S3_BUCKET=devops-portal-storage
AWS_REGION=us-east-1

# For AWS S3 (production)
# S3_ENDPOINT=  # Leave empty for AWS S3
# S3_PATH_STYLE=false
# AWS_ACCESS_KEY_ID=your-access-key
# AWS_SECRET_ACCESS_KEY=your-secret-key
# AWS_SESSION_TOKEN=  # Optional, for STS
# S3_BUCKET=your-bucket-name
# AWS_REGION=us-west-2

# -----------------------------------------------------------------------------
# GitHub Integration (API access)
# -----------------------------------------------------------------------------
GITHUB_TOKEN=your-github-pat
GITHUB_ORGANIZATION=your-org
GITHUB_USE_MOCK_DATA=false

# -----------------------------------------------------------------------------
# ArgoCD Integration
# -----------------------------------------------------------------------------
ARGOCD_URL=https://argocd.example.com
ARGOCD_TOKEN=your-argocd-token
ARGOCD_INSECURE=false

# -----------------------------------------------------------------------------
# Grafana Integration
# -----------------------------------------------------------------------------
GRAFANA_URL=https://grafana.example.com
GRAFANA_API_KEY=your-grafana-api-key
# NEXT_PUBLIC_GRAFANA_URL is no longer needed - URLs resolved server-side

# -----------------------------------------------------------------------------
# Prometheus Integration
# -----------------------------------------------------------------------------
PROMETHEUS_URL=http://prometheus:9090

# -----------------------------------------------------------------------------
# Uptime Kuma Integration
# -----------------------------------------------------------------------------
UPTIME_KUMA_URL=https://uptime.example.com
UPTIME_KUMA_API_KEY=your-uptime-kuma-key

# -----------------------------------------------------------------------------
# Observability
# -----------------------------------------------------------------------------
# OpenTelemetry
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
OTEL_SERVICE_NAME=devops-portal

# Logging
LOG_LEVEL=info

# -----------------------------------------------------------------------------
# Feature Flags (simple boolean for MVP)
# -----------------------------------------------------------------------------
FEATURE_BULK_OPERATIONS=true
FEATURE_COST_INSIGHTS=false
FEATURE_AI_SEARCH=false

# -----------------------------------------------------------------------------
# Rate Limiting
# -----------------------------------------------------------------------------
RATE_LIMIT_GENERAL=100
RATE_LIMIT_BULK=10
RATE_LIMIT_SYNC=30
RATE_LIMIT_AUTH=5

# -----------------------------------------------------------------------------
# TLS Configuration (for self-signed certs in development)
# -----------------------------------------------------------------------------
# NODE_TLS_REJECT_UNAUTHORIZED=0  # Only for development!