# This file documents every variable the app/deployment actually reads.
# In production, setup.sh generates the real file at /opt/anouma/.env for
# you - you shouldn't need to hand-edit this. For local development, copy
# this to .env at the repo root and fill in DATABASE_URI/PAYLOAD_SECRET
# (see README.md → "Lokale Entwicklung").

# ── Database ────────────────────────────────────────────────────────────
# PostgreSQL connection string used by Payload. setup.sh fills this in
# automatically (host "postgres" when running the full stack via Docker
# Compose, matching POSTGRES_USER/PASSWORD/DB below). For a host-only Next
# dev server against the Dockerized Postgres, use "127.0.0.1" instead.
DATABASE_URI=postgresql://postgres:postgres@postgres:5432/anouma

# Only used by the "postgres" service in docker-compose.yml - keep these in
# sync with DATABASE_URI above (setup.sh does this for you).
POSTGRES_USER=postgres
POSTGRES_PASSWORD=replace-with-a-long-random-secret
POSTGRES_DB=anouma

# ── Core secrets ────────────────────────────────────────────────────────
# Signs Payload's auth tokens/cookies. Generate with: openssl rand -hex 32
PAYLOAD_SECRET=replace-with-a-long-random-secret

# Signs meeting join tokens (kept separate from PAYLOAD_SECRET on purpose).
# Generate with: openssl rand -hex 32
MEETING_SESSION_SECRET=replace-with-a-long-random-secret

# Salts the daily-rotating, non-reversible visitor hash used for Analytics
# session grouping (kept separate from PAYLOAD_SECRET on purpose, see
# lib/analytics/salt.ts). Generate with: openssl rand -hex 32
ANALYTICS_SALT_SECRET=replace-with-a-long-random-secret

# Sent as "Authorization: Bearer <value>" by the external cron job that
# triggers /api/cron/event-reminders. Generate with: openssl rand -hex 32
CRON_SECRET=replace-with-a-long-random-secret

# ── Public URL ──────────────────────────────────────────────────────────
# Used by Payload for absolute admin/media links, and to build meeting join
# links inside emails. Set this to the real domain in production.
NEXT_PUBLIC_SERVER_URL=http://localhost:3000

# Cloudflare Turnstile. The site key is public and is passed to the client
# from the server; the secret is used only by the server-side Siteverify call.
TURNSTILE_SITE_KEY=0x4AAAAAAE7AqgHiQF9DffQO
TURNSTILE_SECRET_KEY=
# Local development value. Production must contain only the public hostname:
# TURNSTILE_HOSTNAMES=anouma.org
TURNSTILE_HOSTNAMES=localhost,127.0.0.1

# Port the app container publishes on the host (behind a reverse proxy this
# usually doesn't need to be reachable directly - see DEPLOYMENT.md).
APP_PORT=3000

# ── Email (SMTP) ────────────────────────────────────────────────────────
# The existing ANOUMA mail system - no external newsletter service.
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
# Mailbox address used by the SMTP relay. The app displays ANOUMA as the name.
SMTP_FROM=support@anouma.org
# Keep true for publicly trusted SMTP certificates. Set false only when the
# configured SMTP proxy intentionally uses a private/self-signed certificate.
SMTP_TLS_REJECT_UNAUTHORIZED=true

# Address used as Reply-To for CMS replies. Configure this mailbox with an
# inbound provider/webhook that POSTs replies to /api/email/inbound.
INBOUND_REPLY_TO=reply-to@anouma.org
# Shared secret sent as x-inbound-secret (or Authorization: Bearer ...) by the
# inbound email provider. Generate with: openssl rand -hex 32
INBOUND_EMAIL_SECRET=

# ── LiveKit SFU / embedded TURN ─────────────────────────────────────────
# Public HTTPS endpoint of the self-hosted LiveKit server. The app converts
# https:// to wss:// for browsers and uses the same endpoint for its API.
# Put a trusted TLS reverse proxy in front of LiveKit (normally on :7880).
LIVEKIT_URL=https://livekit.example.com
# Keep these values private. setup.sh generates them automatically.
LIVEKIT_API_KEY=LKreplace-with-setup-secret
LIVEKIT_API_SECRET=replace-with-setup-secret

# ── SEO ──────────────────────────────────────────────────────────────────
# Optional Google Search Console domain-verification token (Search Console →
# Settings → Ownership verification → HTML tag → the "content" value only).
# Leave empty if not verifying with Google. Never commit a real value here.
GOOGLE_SITE_VERIFICATION=

# ── Docker networking ───────────────────────────────────────────────────
# Internal network name for ANOUMA's own containers.
DOCKER_NETWORK=anouma-network

# Name of an existing external Docker network to join (e.g. Nginx Proxy
# Manager's network) so a reverse proxy can reach the app container
# directly. Leave empty if you don't use one - setup.sh auto-detects this.
NPM_NETWORK=

# ── Backups (used by deploy.sh) ─────────────────────────────────────────
# How long (days) to keep database backups created before every deployment.
BACKUP_RETENTION_DAYS=14

# ── Container registry & deployment (used by deploy.sh) ────────────────
# GitHub Container Registry. deploy.sh builds nothing - it only ever pulls
# the image that GitHub Actions built and pushed.
REGISTRY=ghcr.io
REGISTRY_REPO=whitehai11/anouma
# Only needed if the registry/repository requires authentication to pull.
# Use a GitHub token with at least read:packages as the password, not your
# account password.
REGISTRY_USERNAME=
REGISTRY_PASSWORD=
# Set automatically by deploy.sh on every successful deploy - do not edit
# by hand. Empty until the first release has been deployed.
ANOUMA_IMAGE=
# Informational only (shown in the setup summary) - actual automatic
# deployment is controlled by whether release.yml + its GitHub secrets are
# configured, not by this flag.
AUTO_DEPLOY=true