# PicPeak Production Configuration
# Copy this file to .env and update with your production values

# ============================================
# CRITICAL SECURITY - MUST CHANGE ALL VALUES!
# ============================================

# JWT Secret - REQUIRED (minimum 32 characters)
# Generate with: openssl rand -base64 32
JWT_SECRET=CHANGE-THIS-PRODUCTION-SECRET-USE-OPENSSL-COMMAND

# Application URLs - REQUIRED (your actual domain)
FRONTEND_URL=https://your-domain.com
BACKEND_URL=https://your-domain.com
ADMIN_URL=https://your-domain.com

# ============================================
# DATABASE CONFIGURATION - REQUIRED
# ============================================

# PostgreSQL Configuration (Recommended for production)
DATABASE_CLIENT=pg
DB_HOST=db  # Use 'db' for Docker Compose, or external host
DB_PORT=5432
DB_NAME=picpeak
DB_USER=picpeak
DB_PASSWORD=CHANGE-THIS-SECURE-DATABASE-PASSWORD

# ============================================
# EMAIL CONFIGURATION - REQUIRED
# ============================================

# Example: Gmail with App Password
# SMTP_HOST=smtp.gmail.com
# SMTP_PORT=587
# SMTP_SECURE=false
# SMTP_USER=your-email@gmail.com
# SMTP_PASS=your-16-char-app-password
# EMAIL_FROM=Your Name <your-email@gmail.com>

# Example: SendGrid
SMTP_HOST=smtp.sendgrid.net
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=apikey
SMTP_PASS=YOUR-SENDGRID-API-KEY
EMAIL_FROM=PicPeak <noreply@your-domain.com>

# ============================================
# ADMIN SETUP - AUTO-GENERATED
# ============================================
# NOTE: Admin credentials are automatically generated during setup
# DO NOT set ADMIN_EMAIL or ADMIN_PASSWORD anymore!
# Run 'npm run migrate' and check ADMIN_CREDENTIALS.txt

# ============================================
# OPTIONAL CONFIGURATION
# ============================================

# Umami Analytics (Optional - Fallback values)
# Primary config via Admin UI > Settings > Analytics
# UMAMI_URL=https://analytics.your-domain.com
# UMAMI_WEBSITE_ID=your-website-id
# UMAMI_HASH_SALT=your-hash-salt  # Required if using Umami

# Frontend Analytics (Optional - Fallback values)
# VITE_UMAMI_URL=https://analytics.your-domain.com
# VITE_UMAMI_WEBSITE_ID=your-website-id
# VITE_UMAMI_SHARE_URL=https://analytics.your-domain.com/share/xyz/gallery

# ============================================
# PERFORMANCE & SECURITY TUNING
# ============================================

NODE_ENV=production
PORT=3001
LOG_LEVEL=info

# Backend URL (if different from frontend)
# BACKEND_URL=https://api.your-domain.com

# Storage Settings
DEFAULT_EXPIRATION_DAYS=30
WARNING_DAYS_BEFORE_EXPIRY=7

# Security Settings (Defaults are secure)
BCRYPT_ROUNDS=12
SESSION_TIMEOUT_MINUTES=60
RATE_LIMIT_WINDOW_MS=900000     # 15 minutes
RATE_LIMIT_MAX_REQUESTS=100      # per window

# Connection Pool (Adjust based on load)
DB_POOL_MIN=5
DB_POOL_MAX=25

# ============================================
# DOCKER COMPOSE SPECIFIC
# ============================================

# Traefik Configuration (if using Traefik)
DOMAIN=your-domain.com
LETSENCRYPT_EMAIL=admin@your-domain.com

# Volume Paths (Docker)
STORAGE_PATH=/app/storage
EVENTS_PATH=/app/storage/events
ARCHIVE_PATH=/app/storage/events/archived