# =============================================================================
# OrgRepo - Environment Configuration Example
#
# Copy this file to .env and fill in your values.
# NEVER commit the real .env file.
# =============================================================================

# -----------------------------------------------------------------------------
# Django Core
# -----------------------------------------------------------------------------
# Generate with:
#   python -c "from django.core.management.utils import get_random_secret_key; print(get_random_secret_key())"
SECRET_KEY=change-me-to-a-long-random-secret

# Comma-separated hosts (domain or IP of the institutional server)
ALLOWED_HOSTS=localhost,127.0.0.1

# Comma-separated full origins for CSRF (required behind HTTPS domain)
# Example: https://orgrepo.ifmg.edu.br,https://www.ifmg.edu.br
CSRF_TRUSTED_ORIGINS=

# Local Docker smoke test without HTTPS (set True on real TLS edge if needed)
SECURE_SSL_REDIRECT=False
SESSION_COOKIE_SECURE=False
CSRF_COOKIE_SECURE=False
USE_X_FORWARDED_PROTO=True

# Serve PDF uploads from Django when True (works with DEBUG=False under Gunicorn).
# Set False only if a reverse proxy serves /media/ from the media volume.
SERVE_MEDIA=True

# Only for local smoke tests with a weak SECRET_KEY — never in real production
ALLOW_INSECURE_SECRET_KEY=0

# -----------------------------------------------------------------------------
# Database (PostgreSQL — used by Docker Compose web service)
# -----------------------------------------------------------------------------
POSTGRES_DB=orgrepo
POSTGRES_USER=orgrepo
POSTGRES_PASSWORD=change-this-strong-password

# Compose passes POSTGRES_* to the web container; the entrypoint builds an
# URL-encoded DATABASE_URL (safe for passwords with @ : / # etc.).
# For external TI Postgres without Compose, set either POSTGRES_* + POSTGRES_HOST
# or a single DATABASE_URL:
# DATABASE_URL=postgres://orgrepo:pass@postgres-host:5432/orgrepo
# POSTGRES_HOST=postgres-host

# -----------------------------------------------------------------------------
# Bootstrap (ONE-SHOT only — unset after first successful deploy)
# -----------------------------------------------------------------------------
#   (empty)     = no seed on start (normal restarts / upgrades)
#   foundation  = load_consup44_modelos only
#   full        = load_full_data + load_consup44_modelos + sync_cargo_quotas
#
# Do NOT leave RUN_BOOTSTRAP=full permanently: each restart re-runs import/sync
# (skips most existing rows, rewrites media files, rebuilds reference models).
RUN_BOOTSTRAP=

# -----------------------------------------------------------------------------
# Gunicorn / logging
# -----------------------------------------------------------------------------
GUNICORN_WORKERS=3
GUNICORN_TIMEOUT=120
WEB_PORT=8000
LOG_LEVEL=INFO
DB_WAIT_SECONDS=90

# -----------------------------------------------------------------------------
# Optional: Email / Sentry (future)
# -----------------------------------------------------------------------------
# EMAIL_HOST=
# EMAIL_PORT=587
# DEFAULT_FROM_EMAIL=noreply@orgrepo.ifmg.edu.br
# SENTRY_DSN=