# ---- HTTP ----
DOCVAULT_HTTP_ADDR=:8080
# Public base URL the browser hits; used to build the OAuth redirect_uri.
DOCVAULT_PUBLIC_URL=http://localhost:8080

# ---- Postgres ----
DOCVAULT_DATABASE_URL=postgres://docvault:docvault@localhost:5432/docvault?sslmode=disable

# ---- Object storage (S3 / MinIO) ----
DOCVAULT_S3_ENDPOINT=localhost:9000
DOCVAULT_S3_ACCESS_KEY=minioadmin
DOCVAULT_S3_SECRET_KEY=minioadmin
DOCVAULT_S3_BUCKET=docvault
DOCVAULT_S3_USE_SSL=false
DOCVAULT_S3_REGION=us-east-1

# ---- Security ----
# 32-byte (base64) key for encrypting provider OAuth tokens at rest. Generate with:
#   openssl rand -base64 32
DOCVAULT_TOKEN_ENC_KEY=
# Secret used to sign session JWTs. Generate with: openssl rand -base64 48
DOCVAULT_JWT_SECRET=

# ---- Scheduled sync (optional) ----
# When set, the worker auto-enqueues a sync for every linked account whose last
# successful sync is older than this. Go duration (e.g. "6h", "24h"). Empty/0 =
# disabled (sync is on-demand only).
DOCVAULT_SYNC_INTERVAL=

# ---- Feishu / Lark self-built app(s) ----
# Two ways to configure; pick ONE.
#
# (A) Single org — the simple case. Create a self-built app at
#     https://open.feishu.cn/app (or https://open.larksuite.com/app), add redirect URL
#     <DOCVAULT_PUBLIC_URL>/api/auth/feishu/callback, and fill these:
DOCVAULT_FEISHU_APP_ID=
DOCVAULT_FEISHU_APP_SECRET=
# Use "feishu" for feishu.cn, "lark" for larksuite.com
DOCVAULT_FEISHU_DOMAIN=feishu
#
# (B) Multiple orgs — a JSON array, one object per org. Each "key" must be unique and
#     becomes the OAuth route + provider id; register redirect
#     <DOCVAULT_PUBLIC_URL>/api/auth/<key>/callback in that org's app console.
#     When set, this takes precedence over the single (A) vars above.
# DOCVAULT_FEISHU_CONNECTIONS=[{"key":"acme","label":"Acme (Lark)","app_id":"cli_xxx","app_secret":"yyy","domain":"lark"},{"key":"globex","label":"Globex (飞书)","app_id":"cli_zzz","app_secret":"www","domain":"feishu"}]

# ---- Other providers (Google Workspace / Office 365 / 腾讯文档 …) ----
# A JSON array of connections for ANY provider type. "provider_type" selects the
# implementation (feishu | google | microsoft | tencent). "app_id"/"app_secret" are
# the OAuth client id/secret; "domain" is type-specific (feishu/lark for feishu, the
# Entra tenant for microsoft, unused for google/tencent). Register redirect
# <DOCVAULT_PUBLIC_URL>/api/auth/<key>/callback in each provider's app console.
# These are merged with the Feishu vars above; all keys must be globally unique.
# Connections are also manageable from the admin UI after first boot.
# DOCVAULT_PROVIDER_CONNECTIONS=[{"provider_type":"google","key":"gws","label":"Acme (Google)","app_id":"xxx.apps.googleusercontent.com","app_secret":"yyy","domain":""},{"provider_type":"microsoft","key":"o365","label":"Acme (Microsoft 365)","app_id":"<client-id>","app_secret":"zzz","domain":"common"}]