# ── Database ────────────────────────────────────────────────────────────
# PostgreSQL connection string used by Payload. setup.sh fills this in
# automatically (host "postgres" when running the full stack via Docker
# Compose, matching POSTGRES_USER/PASSWORD/DB below). For a host-only Next
# dev server against the Dockerized Postgres, use "127.0.0.1" instead.
DATABASE_URI=postgresql://postgres:postgres@postgres:5432/anouma

# Only used by the "postgres" service in docker-compose.yml — keep these in
# sync with DATABASE_URI above (setup.sh does this for you).
POSTGRES_USER=postgres
POSTGRES_PASSWORD=replace-with-a-long-random-secret
POSTGRES_DB=anouma

# ── Core secrets ────────────────────────────────────────────────────────
# Signs Payload's auth tokens/cookies. Generate with: openssl rand -base64 48
PAYLOAD_SECRET=replace-with-a-long-random-secret

# Signs meeting join tokens (kept separate from PAYLOAD_SECRET on purpose).
# Generate with: openssl rand -base64 48
MEETING_SESSION_SECRET=replace-with-a-long-random-secret

# Sent as "Authorization: Bearer <value>" by the external cron job that
# triggers /api/cron/event-reminders. Generate with: openssl rand -hex 32
CRON_SECRET=replace-with-a-long-random-secret

# ── Public URL ──────────────────────────────────────────────────────────
# Used by Payload for absolute admin/media links, and to build meeting join
# links inside emails. Set this to the real domain in production.
NEXT_PUBLIC_SERVER_URL=http://localhost:3000

# Port the app container publishes on the host (behind a reverse proxy this
# usually doesn't need to be reachable directly — see DEPLOYMENT.md).
APP_PORT=3000

# ── Email (SMTP) ────────────────────────────────────────────────────────
# The existing ANOUMA mail system — no external newsletter service.
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM="ANOUMA <support@anouma.org>"

# ── WebRTC (STUN/TURN) ──────────────────────────────────────────────────
# P2P works with just STUN for most networks. Add a TURN server later for
# restrictive NATs/firewalls — no code changes needed, just set these.
STUN_SERVER=stun:stun.l.google.com:19302
TURN_SERVER=
TURN_USERNAME=
TURN_PASSWORD=

# ── Docker networking ───────────────────────────────────────────────────
# Internal network name for ANOUMA's own containers.
DOCKER_NETWORK=anouma-network

# Name of an existing external Docker network to join (e.g. Nginx Proxy
# Manager's network) so a reverse proxy can reach the app container
# directly. Leave empty if you don't use one — setup.sh auto-detects this.
NPM_NETWORK=

# ── Updates & backups (used by update.sh) ──────────────────────────────
# When true, setup.sh installs a cron entry that checks for new releases
# and updates automatically. Off by default — update.sh can always be run
# manually regardless of this setting.
AUTO_UPDATE=false

# How long (days) to keep database backups created by update.sh before
# deleting them.
BACKUP_RETENTION_DAYS=14