# ===========================================================================
# mitbringsl backend configuration
# Copy this file to ".env" and adjust the values.
#   cp .env.example .env
# ===========================================================================

# --- General app behavior ---
APP_ENV=production                  # development | production
LOG_LEVEL=info                      # debug | info | warn | error

# The externally reachable base URL (scheme + host, no trailing slash).
# Must match the domain you serve Caddy on. Used for OIDC redirect URIs etc.
PUBLIC_BASE_URL=https://mitbringsl.example.com

# The public domain Caddy serves. Used to set the Caddy site address.
PUBLIC_DOMAIN=mitbringsl.example.com

# --- PostgreSQL ---
POSTGRES_USER=app
# CHOOSE A STRONG PASSWORD (only required for first DB init, then stored).
POSTGRES_PASSWORD=change-me-to-a-long-random-string
POSTGRES_DB=appdb
# DATABASE_URL is composed by docker-compose from the values above.

# --- Session tokens ---
# TTL of the opaque session token issued after login.
SESSION_TOKEN_TTL=720h              # 30 days

# --- OIDC: Google (optional) ---
OIDC_GOOGLE_ENABLED=false
# The OAuth client ID you created in Google Cloud Console (Audience the
# backend accepts). No client_secret needed: the Android app performs the
# code exchange itself and only sends the id_token to the backend.
OIDC_GOOGLE_CLIENT_ID=
OIDC_GOOGLE_ISSUER=https://accounts.google.com

# --- OIDC: Generic provider (Keycloak, Authentik, Dex, ...; optional) ---
OIDC_GENERIC_ENABLED=false
OIDC_GENERIC_ISSUER=                # e.g. https://idp.example.com/realms/main
OIDC_GENERIC_CLIENT_ID=             # audience the backend accepts

# --- CORS (only relevant for browser clients; Android doesn't need it) ---
# Comma-separated list of allowed origins, e.g. https://app.example.com
CORS_ALLOWED_ORIGINS=