# Tribu Environment Variables
# Copy to .env and fill in values:  cp .env.example .env

# ── Required ──────────────────────────────────────────────────

# Generate with: openssl rand -hex 32
JWT_SECRET=

# Database password for PostgreSQL
# Generate with: openssl rand -hex 16
POSTGRES_PASSWORD=

# ── Optional ──────────────────────────────────────────────────

# Set to true when running behind a TLS reverse proxy (nginx, Caddy, Traefik)
# This enables the Secure flag on auth cookies (HTTPS only)
SECURE_COOKIES=false

# Public URL of your instance (e.g. https://tribu.example.com)
# Auto-detected from request headers if not set
# BASE_URL=

# Short-lived access cookie lifetime, in hours (default: 24)
# The web app can refresh active sessions with a revocable httpOnly refresh cookie.
# JWT_EXPIRE_HOURS=24

# Refresh session lifetime, in days (default: 30)
# Keep JWT_SECRET stable in your persisted .env to preserve sessions across container updates.
# REFRESH_TOKEN_EXPIRE_DAYS=30

# IANA timezone used for family calendar/task times, quiet hours, and reminders.
# Audit/session timestamps stay in UTC. Leave unset for UTC fallback.
# Examples: Europe/Berlin, America/New_York.
# TZ=Europe/Berlin

# Extra exact browser origins for direct backend access. Default only allows localhost.
# CORS_ALLOWED_ORIGINS=https://tribu.example.com

# Set true only if you deliberately expose the backend to 192.168.x.x browser origins.
# CORS_ALLOW_LAN_ORIGINS=false

# Comma-separated trusted reverse proxy CIDRs for X-Forwarded-For rate-limit keys.
# TRUSTED_PROXY_CIDRS=172.16.0.0/12

# Set true only if ICS subscriptions must fetch LAN/private calendar feeds.
# SUBSCRIPTIONS_ALLOW_PRIVATE_NETWORKS=false

# ── Push Notifications (optional) ────────────────────────────
# Generate keys with: npx web-push generate-vapid-keys

# VAPID_PUBLIC_KEY=
# VAPID_PRIVATE_KEY=
# VAPID_CLAIMS_EMAIL=admin@example.com