# Fizzy Docker Compose environment variables example
# Copy to .env before use: cp .env.example .env
#
# Required (one of the two; container has no config/master.key, must provide via env):
#   1) RAILS_MASTER_KEY=  (same as config/master.key, used to decrypt credentials)
#   2) SECRET_KEY_BASE=   (e.g. bin/rails secret; overrides credentials)

# Master key (decrypts config/credentials.yml.enc)
RAILS_MASTER_KEY=

# If credentials were never edited/saved, you can use SECRET_KEY_BASE instead (overrides credentials)
# SECRET_KEY_BASE=

# Optional: when using MySQL, set these and run docker compose --profile mysql up -d
# DATABASE_ADAPTER=mysql
# MYSQL_USER=fizzy
# MYSQL_PASSWORD=
# MYSQL_ROOT_PASSWORD=rootpassword

# Optional: public app URL (e.g. for email links)
# BASE_URL=http://localhost:3006

# Optional: SMTP mail
# SMTP_ADDRESS=
# SMTP_PORT=587
# SMTP_USERNAME=
# SMTP_PASSWORD=
# MAILER_FROM_ADDRESS=

# Optional: multi-tenant
# MULTI_TENANT=false

# Optional: disable and hide all export data (account export + user data export)
# DISABLE_EXPORT_DATA=true

# Optional: hide user email addresses in the UI (profile, settings, boards, API); show placeholder instead
# HIDE_EMAILS=true

# Optional: Forward Auth (trust X-Auth-Email etc. when gateway has authenticated; no magic link)
# See docs/forward_auth.md
# FORWARD_AUTH_ENABLED=true
# Trust: use one or both
# - Trusted IPs: if requests go through Traefik in Docker, Fizzy may see 172.x; include 172.16.0.0/12
# FORWARD_AUTH_TRUSTED_IPS=127.0.0.1,10.0.0.0/8,172.16.0.0/12
# - Secret header: recommended when proxy forwards X-Forwarded-For (not IP-dependent)
# FORWARD_AUTH_SECRET_HEADER=X-Forward-Auth-Verified
# FORWARD_AUTH_SECRET=your-long-random-secret
# Auto-provision: create Identity/User when they do not exist
# FORWARD_AUTH_AUTO_PROVISION=true
# Default role when auto-provisioning: owner|admin|member|system
# FORWARD_AUTH_DEFAULT_ROLE=member
# Create Fizzy session after auth (recommend true; otherwise every request needs Forward Auth headers)
# FORWARD_AUTH_CREATE_SESSION=true
# Use email local part as display name and lock email (e.g. soulteary@example.com → soulteary, email not editable)
# FORWARD_AUTH_USE_EMAIL_LOCAL_PART_AND_LOCK_EMAIL=true
# When user has no accounts, auto-create one (default true, avoids "no accounts" page)
# FORWARD_AUTH_AUTO_CREATE_ACCOUNT=true
# Name of auto-created account (default My Workspace)
# FORWARD_AUTH_AUTO_CREATE_ACCOUNT_NAME=My Workspace