# Buzzy Docker Compose environment variables example
# Copy to .env before use: cp .env.example .env
#
# This file is only used by Docker Compose to substitute variables (e.g. ${SMTP_ADDRESS}).
# The app inside the container does not read .env; it receives these values via the container environment.
#
# 必填其一（否则 production 无法启动）：
# Required (one of the two; container has no config/master.key, must provide via env):
#   1) RAILS_MASTER_KEY=  (same as config/master.key, used to decrypt credentials)
#   2) SECRET_KEY_BASE=   (e.g. bin/rails secret; overrides credentials)

# Master key (decrypts config/credentials.yml.enc)
RAILS_MASTER_KEY=

# If credentials were never edited/saved, you can use SECRET_KEY_BASE instead (overrides credentials)
# SECRET_KEY_BASE=

# Optional: when using MySQL, set these and run docker compose --profile mysql up -d
# DATABASE_ADAPTER=mysql
# MYSQL_USER=buzzy
# MYSQL_PASSWORD=
# MYSQL_ROOT_PASSWORD=rootpassword

# Optional: public app URL (e.g. for email links)
# BASE_URL=http://localhost:3006

# Optional: SMTP mail. In Docker, Compose injects these into the container.
# For local development (rails s): set env vars in your shell, or create tmp/email-dev.txt for letter_opener.
# SMTP_ADDRESS=
# SMTP_PORT=587
# SMTP_USERNAME=
# SMTP_PASSWORD=
# MAILER_FROM_ADDRESS=

# Optional: multi-tenant
# MULTI_TENANT=false

# Optional: disable and hide all export data (account export + user data export)
# DISABLE_EXPORT_DATA=true

# Optional: Bullet N+1 检测。development 默认开启，设为 false 关闭；staging 需设为 true 才开启（见 docs/mysql-performance-checklist.md）
# BULLET_ENABLED=false

# Optional: hide user email addresses in the UI (profile, settings, boards, API); show placeholder instead
# HIDE_EMAILS=true

# Optional: super-admin emails (comma-separated). These users can view all boards and the "Everyone's content" page.
# ADMIN_EMAILS=admin@example.com,other@example.com

# Optional: Forward Auth (trust X-Auth-Email etc. when gateway has authenticated; no magic link)
# See docs/forward_auth.md
# FORWARD_AUTH_ENABLED=true
# Trust: use one or both
# - Trusted IPs: if requests go through Traefik in Docker, Buzzy may see 172.x; include 172.16.0.0/12
# FORWARD_AUTH_TRUSTED_IPS=127.0.0.1,10.0.0.0/8,172.16.0.0/12
# - Secret header: recommended when proxy forwards X-Forwarded-For (not IP-dependent)
# FORWARD_AUTH_SECRET_HEADER=X-Forward-Auth-Verified
# FORWARD_AUTH_SECRET=your-long-random-secret
# Auto-provision: create Identity/User when they do not exist
# FORWARD_AUTH_AUTO_PROVISION=true
# Default role when auto-provisioning: owner|admin|member|system
# FORWARD_AUTH_DEFAULT_ROLE=member
# Create Buzzy session after auth (recommend true; otherwise every request needs Forward Auth headers)
# FORWARD_AUTH_CREATE_SESSION=true
# Use email local part as display name and lock email (e.g. soulteary@example.com → soulteary, email not editable)
# FORWARD_AUTH_USE_EMAIL_LOCAL_PART_AND_LOCK_EMAIL=true
# When user has no accounts, auto-create one (default true, avoids "no accounts" page)
# FORWARD_AUTH_AUTO_CREATE_ACCOUNT=true
# Name of auto-created account (default My Workspace)
# FORWARD_AUTH_AUTO_CREATE_ACCOUNT_NAME=My Workspace