# =============================================================================
# Porter - Environment Configuration
# =============================================================================
# Copy this file to .env and fill in all values marked with "change_me_".
# Do NOT commit .env to version control.
# =============================================================================


# ------------------------------------------------------------------------------
# Public URLs
# ------------------------------------------------------------------------------
# These URLs must be reachable by end users (Docker CLI and browsers).
# Configure your host reverse proxy (nginx, Caddy, traefik, etc.) to forward
# traffic to the Docker services bound to 127.0.0.1 below.
#
#   registry.example.com  -> 127.0.0.1:5000   (registry)
#   console.example.com   -> 127.0.0.1:3000   (API server + console SPA)
#
# For local development, keep the localhost defaults.
# ------------------------------------------------------------------------------

# Public URL of the Docker registry. Docker clients use this to login/push/pull.
# Example: https://registry.example.com
REGISTRY_PUBLIC_URL=http://localhost:5000

# Origin of the console SPA. In the bundled production deployment, the SPA and
# API are served from this same origin; do not set the removed CONSOLE_API_URL.
# In production this must be the public console URL (without /api).
# Example: https://console.registry.example.com
CONSOLE_ORIGIN=http://localhost:3000


# ------------------------------------------------------------------------------
# PostgreSQL
# ------------------------------------------------------------------------------
# Used by the Go API server for all business data (users, projects, repos,
# tags, audit logs). Postgres runs inside Docker; no external port is exposed.
# ------------------------------------------------------------------------------

# Name of the database created on first startup.
POSTGRES_DB=registry_console

# Postgres superuser name.
POSTGRES_USER=registry

# Postgres password. Generate a strong random string (e.g. `openssl rand -hex 32`).
# Avoid characters like "/" or "+" — the value is interpolated into DATABASE_URL.
# This same value is referenced by the API server to build its DATABASE_URL.
POSTGRES_PASSWORD=change_me_postgres_password


# ------------------------------------------------------------------------------
# Redis
# ------------------------------------------------------------------------------
# Used for blob descriptor cache (registry), rate limiting, and session
# deduplication. Redis runs inside Docker; no external port is exposed.
# ------------------------------------------------------------------------------

# Redis AUTH password. Generate a strong random string.
# The registry, API server, and Redis container itself all use this value.
REDIS_PASSWORD=change_me_redis_password


# ------------------------------------------------------------------------------
# Cloudflare R2 (Production only)
# ------------------------------------------------------------------------------
# R2 is an S3-compatible object store. In production the registry stores image
# layers and manifests in R2. In development the registry uses local filesystem
# storage instead, so these values are ignored when running docker-compose.dev.yml.
#
# How to obtain:
#   1. Create a bucket in the Cloudflare R2 dashboard.
#   2. Go to "R2 API Tokens" and create a token with "Object Read & Write".
#   3. Copy the Account ID, Access Key ID, and Secret Access Key shown.
# ------------------------------------------------------------------------------

# Your Cloudflare account ID (found on the right sidebar of the dashboard).
R2_ACCOUNT_ID=your_cloudflare_account_id

# R2 API token Access Key ID.
R2_ACCESS_KEY_ID=your_r2_access_key_id

# R2 API token Secret Access Key (shown only once during creation).
R2_SECRET_ACCESS_KEY=your_r2_secret_access_key

# Name of the R2 bucket the registry will read/write.
R2_BUCKET_NAME=private-registry


# ------------------------------------------------------------------------------
# Registry Token Authentication
# ------------------------------------------------------------------------------
# The Docker registry delegates authentication to the Go API server via the
# Bearer token spec (Docker Registry v2 token auth). These values configure
# the JWT tokens issued by the API and validated by the registry.
# ------------------------------------------------------------------------------

# A random secret string used by the registry to sign HTTP session state.
# Generate with: openssl rand -base64 32
REGISTRY_HTTP_SECRET=change_me_registry_http_secret

# The "service" claim in registry token auth. Must match the registry's
# auth.token.service config. Usually set to your registry public domain.
# Example: registry.example.com
REGISTRY_SERVICE=registry.example.com

# The "issuer" claim in registry JWTs. Can be any stable identifier string.
# Must match auth.token.issuer in registry/config.yml.
REGISTRY_TOKEN_ISSUER=private-registry-auth

# Public URL of the token endpoint that the registry redirects Docker clients to.
# Must match auth.token.realm in registry/config.yml.
# Example: https://console.registry.example.com/api/registry/token
REGISTRY_TOKEN_REALM=https://console.registry.example.com/api/registry/token


# ------------------------------------------------------------------------------
# API Server
# ------------------------------------------------------------------------------
# The Go API server handles console auth, project management, tag operations,
# audit logging, and registry token issuance.
# ------------------------------------------------------------------------------

# Host port the API server is published on (bound to 127.0.0.1).
# The container always listens on 3000 internally; this only changes the host port.
API_PORT=3000

# Secret key used to sign and verify console session cookies (HMAC-SHA256).
# MUST be at least 32 characters. Generate with: openssl rand -base64 32
# Rotating this invalidates all active user sessions.
API_JWT_SECRET=change_me_console_session_secret

# Comma-separated CIDRs/IPs for proxies allowed to supply X-Forwarded-For.
# For host nginx forwarding to the Docker-published API port, set the Docker
# bridge subnet only when you need client IP based rate limiting/logging.
# Example: TRUSTED_PROXIES=172.17.0.0/16
TRUSTED_PROXIES=

# Shared secret for authenticating registry webhook events.
# The registry includes this in the Authorization header when pushing events
# to the API server's /internal/registry/events endpoint.
# Generate with: openssl rand -base64 32
WEBHOOK_SECRET=change_me_registry_webhook_secret


# ------------------------------------------------------------------------------
# Initial Admin Account
# ------------------------------------------------------------------------------
# On first startup the API server creates a platform_admin user with these
# credentials if no users exist in the database. Set a strong password before
# the first startup: there is currently no self-service password-change UI.
# ------------------------------------------------------------------------------

# Email address of the bootstrap platform admin.
BOOTSTRAP_ADMIN_EMAIL=admin@example.com

# Password for the bootstrap admin. Must be at least 8 characters.
BOOTSTRAP_ADMIN_PASSWORD=change_me_admin_password