# =============================================================================
#  maintainerd-auth — SAMPLE environment (examples/quickstart)
#
#  SAMPLE ONLY. Placeholder, non-secret values — safe to commit and share.
#  There are NO real credentials here.
#
#  Usage:  cp .env.example .env  &&  ./setup.sh  &&  docker compose up -d
#  Never commit your filled-in `.env`.
#
#  Active settings below make the local quickstart work as-is. Commented lines
#  show optional settings with their defaults. Full reference:
#  https://github.com/maintainerd/maintainerd-auth/blob/main/docs/contributing/environment-variables.md
# =============================================================================

# --- Application ------------------------------------------------------------
APP_ENV=development
# APP_VERSION=              # optional; normally baked into the image
# MANAGEMENT_PORT=8082      # health + Prometheus /metrics (keep internal)
# APP_CONSOLE_PORT=3000     # console SPA port (behind nginx)
# APP_IDENTITY_PORT=3001    # identity SPA port (behind nginx)
# LOG_LEVEL=info            # debug | info | warn | error

# --- Hostnames (served by nginx over HTTPS, no ports) -----------------------
APP_FRONTEND_CONSOLE_HOSTNAME=https://console.auth.maintainerd.local
APP_FRONTEND_IDENTITY_HOSTNAME=https://identity.auth.maintainerd.local
APP_PUBLIC_HOSTNAME=https://identity-api.auth.maintainerd.local     # OIDC issuer + public API
APP_PRIVATE_HOSTNAME=https://console-api.auth.maintainerd.local     # control plane (internal)

# --- Cookies ----------------------------------------------------------------
COOKIE_SECURE=true          # nginx terminates TLS, so cookies ride HTTPS
COOKIE_SAMESITE=lax         # keep lax — needed for federated SSO redirects
# COOKIE_DOMAIN=auth.maintainerd.local   # set to share ONE session across console + identity

# --- Proxy / CORS / WebAuthn ------------------------------------------------
TRUST_ALL_PROXIES=true      # trust the single nginx hop (local only)
# TRUSTED_PROXY_CIDRS=      # restrict to specific proxy CIDRs instead of trusting all
# CORS_ALLOWED_ORIGINS=     # extra allowed origins (tenant/client origins are auto-allowed)
# Passkeys: RP ID must be a registrable parent of every surface that enrolls a
# passkey. One credential then works across all of them (console + identity, and
# any *.auth.maintainerd.local tenant subdomain), and each ceremony's origin is
# validated against this RP ID at runtime — no explicit origin list is needed.
# Without it, enrollment fails with "'rp.id' cannot be used with the current origin".
WEBAUTHN_RP_ID=auth.maintainerd.local

# --- PostgreSQL (matches the docker-compose service names) -------------------
DB_HOST=postgres
DB_PORT=5432
DB_USER=maintainerd
DB_PASSWORD=change-me
DB_NAME=maintainerd
DB_SSLMODE=disable          # use require / verify-full in production
# DB_MAX_OPEN_CONNS=25
# DB_MAX_IDLE_CONNS=10
# DB_CONN_MAX_LIFETIME_SEC=300
# DB_STATEMENT_TIMEOUT_MS=30000

# --- Redis ------------------------------------------------------------------
REDIS_ADDR=redis:6379
# REDIS_PASSWORD=           # if your Redis requires AUTH
# REDIS_TLS=false           # true to dial Redis over TLS

# --- Event bus (optional; unset = disabled) ---------------------------------
# Webhooks / integration events need RabbitMQ. Not in this compose by default.
# RABBITMQ_URL=amqp://guest:guest@rabbitmq:5672/

# --- CAPTCHA (optional; unset = off) ----------------------------------------
# CAPTCHA_SECRET=
# CAPTCHA_VERIFY_URL=https://www.google.com/recaptcha/api/siteverify
# CAPTCHA_MIN_SCORE=0.5

# --- Keys & secret provider -------------------------------------------------
# SECRET_PROVIDER=env        # env | file | aws_secrets | aws_ssm | vault | azure_kv | gcp
# JWT_KEY_ID=maintainerd-auth-key-1
# JWT_KEY_ROTATION_PERIOD_SECONDS=86400
# APP_ENCRYPTION_KEYS_PREVIOUS=   # comma-separated retired 32-byte keys during a rotation
# Vault / AWS / Azure / GCP provider options + control-plane (gRPC/mTLS) settings:
# see the Environment Variables reference linked at the top of this file.

# --- Observability (optional) -----------------------------------------------
# OTEL_ENABLED=false
# OTEL_SERVICE_NAME=maintainerd-auth
# OTEL_EXPORTER_OTLP_ENDPOINT=

# --- Local testing convenience ----------------------------------------------
# No email/SMS provider configured yet? Uncomment to print OTP codes to the
# container logs so you can test OTP flows locally. NEVER enable in production.
# MAINTAINERD_DEV_LOG_OTP=true

# --- Secrets (generated by ./setup.sh — do NOT hand-write) ------------------
# setup.sh appends: APP_ENCRYPTION_KEY, HMAC_SECRET_KEY, JWT_PRIVATE_KEY,
# JWT_PUBLIC_KEY (all local, via openssl). Standalone setup uses the REST setup
# wizard, so leave SETUP_BOOTSTRAP_TOKEN and CONTROL_PLANE_ENABLED unset.