# ═══════════════════════════════════════════════════════════════════════════════
#  $APP_NAME — Environment Variables Template
#  Copy to .env and fill in all CHANGE_ME values before deploying.
#
#  Self-hosted setup (recommended):
#    1. cp .env.example .env
#    2. Fill in every CHANGE_ME value below
#    3. npm install
#    4. npm start          (or: pm2 start server.js --name $APP_NAME)
#    5. Point Nginx to PORT (see nginx.conf.example)
#
#  Generate random secrets with:
#    node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# ═══════════════════════════════════════════════════════════════════════════════

# ── App ───────────────────────────────────────────────────────────────────────
APP_NAME=starr
NODE_ENV=production
ORIGIN_GUARD_DISABLED=false   # set to true in dev to allow Postman/curl (ignored in production)
PORT=3024
APP_URL=https://api.yourdomain.com
APP_LOGO_URL=https://your-cdn.com/logo.png
FRONTEND_URL=https://yourdomain.com

# ── Database (PostgreSQL / CockroachDB) ──────────────────────────────────────
#  For self-hosted PostgreSQL:  DB_HOST=127.0.0.1  DB_PORT=5432
#  For CockroachDB serverless:  DB_HOST=<cluster>.cockroachlabs.cloud  DB_PORT=26257
DB_HOST=CHANGE_ME
DB_PORT=5432
DB_NAME=CHANGE_ME
DB_USER=CHANGE_ME
DB_PASSWORD=CHANGE_ME
#  DB_SSL=false  → disable SSL (use when PostgreSQL is on the same Docker network)
#  DB_SSL=true   → enable SSL with rejectUnauthorized=false (default — for managed DBs)
DB_SSL=true

# ── Cache driver ──────────────────────────────────────────────────────────────
#  Controls the store used by rate limiters and the CSRF session.
#
#  memory → no Redis required. Safe for local development (single process).
#           Rate limit counters reset on restart; CSRF sessions are in-process.
#           Set this in your local .env — no Redis installation needed.
#
#  redis  → Redis or Valkey required. Use in production (multi-process safe,
#           survives restarts). Requires REDIS_URL below.
#
CACHE_DRIVER=redis

# ── Redis / Valkey URL ────────────────────────────────────────────────────────
#  Only read when CACHE_DRIVER=redis.
#  Valkey is a drop-in Redis replacement — fully supported.
#  Arch Linux / Valkey default port: 6380
#  Ubuntu / Debian / macOS Redis default port: 6379
#  Check your port: systemctl status valkey | grep "valkey-server"
#  Managed TLS example: rediss://:<password>@<host>:6380
REDIS_URL=redis://127.0.0.1:6379

# ── JWT ───────────────────────────────────────────────────────────────────────
#  Generate each secret independently — never reuse across fields.
JWT_SECRET=CHANGE_ME_32_BYTE_HEX
MEDIA_JWT_SECRET=CHANGE_ME_32_BYTE_HEX
JWT_EXPIRES_IN=15m
JWT_REFRESH_SECRET=CHANGE_ME_32_BYTE_HEX
JWT_REFRESH_EXPIRES_IN=7d

# ── CSRF & Cookies ────────────────────────────────────────────────────────────
SESSION_SECRET=CHANGE_ME_32_BYTE_HEX

# ── Google OAuth ──────────────────────────────────────────────────────────────
#  console.cloud.google.com → Credentials → OAuth 2.0 Client ID
#  Add https://api.yourdomain.com/api/auth/google/callback to Authorized redirect URIs
GOOGLE_CLIENT_ID=CHANGE_ME
GOOGLE_CLIENT_SECRET=CHANGE_ME
GOOGLE_CALLBACK_URL=https://api.yourdomain.com/api/auth/google/callback

# ── PayPal ────────────────────────────────────────────────────────────────────
#  Switch PAYPAL_ENV from "sandbox" to "live" when ready for real payments.
#  Live credentials come from developer.paypal.com → My Apps & Credentials → Live tab.
PAYPAL_CLIENT_ID=CHANGE_ME
PAYPAL_CLIENT_SECRET=CHANGE_ME
PAYPAL_ENV=live

# ── Email (SMTP) ──────────────────────────────────────────────────────────────
#  Gmail: enable 2FA → generate an App Password at myaccount.google.com/apppasswords
#  For higher volume use a transactional provider (Mailgun, Resend, SendGrid, etc.)
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=CHANGE_ME@gmail.com
SMTP_PASS=CHANGE_ME_APP_PASSWORD
EMAIL_FROM=CHANGE_ME@gmail.com

OTP_EXPIRY_MINUTES=10

# ── S3-compatible Storage (Garage self-hosted) ────────────────────────────────
#  Garage is bundled in docker-compose.yml — no separate install needed.
#
#  Docker setup:   S3_ENDPOINT=http://garage:3900  (use the service name)
#  Bare-metal:     S3_ENDPOINT=http://127.0.0.1:3900
#
#  S3_PUBLIC_URL: public-facing URL served by your reverse proxy
#                 (e.g. Caddy/Nginx → https://cdn.yourdomain.com → garage:3900)
#
#  GARAGE_RPC_SECRET: shared secret for Garage RPC.
#  Generate with:  openssl rand -hex 32
S3_ENDPOINT=http://garage:3900
S3_REGION=garage
S3_ACCESS_KEY=CHANGE_ME
S3_SECRET_KEY=CHANGE_ME
S3_BUCKET=CHANGE_ME
S3_PUBLIC_URL=https://cdn.yourdomain.com
GARAGE_RPC_SECRET=CHANGE_ME_32_BYTE_HEX

# ── Chibisafe (optional — used alongside S3 for some asset types) ─────────────
#  Set CHIBISAFE_BASE_URL to the public domain pointing to your Chibisafe instance.
CHIBISAFE_BASE_URL=https://files.yourdomain.com
CHIBISAFE_API_KEY=CHANGE_ME
CHIBISAFE_ALBUM_AVATARS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_IMAGES=CHANGE_ME_UUID
CHIBISAFE_ALBUM_VIDEOS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_THUMBNAILS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_DOCUMENTS=CHANGE_ME_UUID
CHIBISAFE_ALBUM_ARCHIVED=CHANGE_ME_UUID

# ── CORS ──────────────────────────────────────────────────────────────────────
#  Comma-separated list of allowed origins. Must match FRONTEND_URL exactly.
ALLOWED_ORIGINS=https://yourdomain.com