# ClassroomIO Docker Self-Hosting Environment
# Copy this file to .env and fill in your values.
# For local development, the defaults work out of the box.
# For production, replace all placeholder values.

# ──────────────────────────────────────────────
# Required
# ──────────────────────────────────────────────

# Database (used by docker-compose to create the Postgres container)
POSTGRES_DB=classroomio
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres

# Public URL where the API is reachable from browsers
# Local: http://localhost:3081 | Production: https://api.yourdomain.com
PUBLIC_SERVER_URL=http://localhost:3081

# Comma-separated origins allowed by CORS
# Local: http://localhost:3082 | Production: https://app.yourdomain.com
TRUSTED_ORIGINS=http://localhost:3082,http://localhost:5173

# Auth secret for session signing (use a long random string in production)
BETTER_AUTH_SECRET=replace-with-a-long-random-secret

# API bearer token (leave blank — auto-generated by ./run-docker-full-stack.sh)
AUTH_BEARER_TOKEN=

# Dashboard-to-API auth key (leave blank — auto-generated by ./run-docker-full-stack.sh)
# Must be the same value in both API and dashboard.
PRIVATE_SERVER_KEY=

# Self-hosted mode flag
PUBLIC_IS_SELFHOSTED=true

# Dashboard SSR calls to the API inside the Docker network
# Local: http://api:3081 | Production: http://api:3081 (always internal)
PRIVATE_SERVER_URL=http://api:3081

# Dashboard origin for SvelteKit CSRF protection
# Local: http://localhost:3082 | Production: https://app.yourdomain.com
DASHBOARD_ORIGIN=http://localhost:3082

# CSP: external domains allowed by Content-Security-Policy (required when self-hosted)
# Comma-separated. Include your CDN, API, video, and font domains.
ALLOWED_EXTERNAL_DOMAINS=

# ──────────────────────────────────────────────
# Optional — Email (pick one approach, or skip)
# ──────────────────────────────────────────────

# Option A: Zoho / ZeptoMail
ZOHO_TOKEN=

# Option B: SMTP
SMTP_HOST=
SMTP_PORT=
SMTP_USER=
SMTP_PASSWORD=
SMTP_SENDER=

# ──────────────────────────────────────────────
# Optional — Object Storage (auto-configured by ./run-docker-full-stack.sh)
# ──────────────────────────────────────────────

# MinIO is included by default. The startup script sets these automatically.
# Change credentials in production.
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minioadmin
OBJECT_STORAGE_ENDPOINT=http://minio:9000
OBJECT_STORAGE_PUBLIC_ENDPOINT=http://localhost:9000
OBJECT_STORAGE_ACCESS_KEY_ID=minioadmin
OBJECT_STORAGE_SECRET_ACCESS_KEY=minioadmin
OBJECT_STORAGE_FORCE_PATH_STYLE=true
OBJECT_STORAGE_MEDIA_PUBLIC_BASE_URL=http://localhost:9000/media

# ──────────────────────────────────────────────
# Optional — Integrations
# ──────────────────────────────────────────────

# Google OAuth
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Cookie domain for cross-subdomain auth (e.g. .yourdomain.com)
AUTH_COOKIE_DOMAIN=

# Dashboard domain routing
PRIVATE_APP_HOST=localhost
PRIVATE_APP_SUBDOMAINS=app

# Unsplash image search
UNSPLASH_API_KEY=

# Enterprise license (SSO, token-auth, no-tracking)
LICENSE_KEY=

# Custom branding (meta tags)
# PUBLIC_APP_TITLE=My Learning Platform
# PUBLIC_APP_DESCRIPTION=A flexible LMS
# PUBLIC_OG_IMAGE_URL=https://app.yourdomain.com/og-image.png