# =============================================================================
# Env untuk panel yang berjalan sebagai CONTAINER.
# Salin ke .env LALU ISI NILAINYA (jangan commit .env):
#     cp deploy/panel/env.example deploy/panel/.env
#
# Beda penting dari .env dev (panel di host):
#   - Panel di container TIDAK bisa membaca filesystem platform → WAJIB pakai
#     config-agent (`configUrl`) di SICABE_HOSTS.
#   - Alamat ke service di HOST memakai `host.docker.internal` (atau
#     `network_mode: host`, lihat docker-compose.yml).
# =============================================================================

# ── Wajib ────────────────────────────────────────────────────────────────────
# URL publik panel — HARUS sama dengan yang diakses browser.
NEXTAUTH_URL=http://localhost:3000
# Rahasia NextAuth (WAJIB di produksi). Buat: openssl rand -base64 32
NEXTAUTH_SECRET=

# ── Login lokal (hybrid dengan SSO) — OPSIONAL ───────────────────────────────
#PANEL_LOCAL_USER=admin
#PANEL_LOCAL_PASSWORD_HASH=$2b$10$...
#PANEL_LOCAL_PASSWORD_HASH_B64=
#PANEL_LOCAL_ROLE=data-admin
#TRINO_SERVICE_ACCOUNT=svc_dbt

# ── Keycloak (SSO & login dev ROPC) ──────────────────────────────────────────
# Dari container, Keycloak di host diakses via host.docker.internal.
KEYCLOAK_URL=http://host.docker.internal:12080
KEYCLOAK_CLIENT_ID=sicabe-control-panel
KEYCLOAK_CLIENT_SECRET=dev-keycloak-secret
# URL yang dilihat browser (tautan Keycloak).
KEYCLOAK_WEB_URL=http://localhost:12080
#KEYCLOAK_REALM=sicabe

# ── Host/agent yang dikelola (WAJIB configUrl) ───────────────────────────────
# Gateway per host (nginx: docker-proxy + config-agent) jalan di HOST:22375.
# Dari container → host.docker.internal:22375. `publicHost` = alamat yang
# dilihat BROWSER (untuk tautan UI), mis. IP LAN host.
SICABE_HOSTS='[{"name":"local-gw","proxyUrl":"http://host.docker.internal:22375","apiKey":"<gateway-key>","configUrl":"http://host.docker.internal:22375","configApiKey":"<gateway-key>","publicHost":"localhost","enabled":true}]'

# ── Service (fallback; registry hasil scan diutamakan) ───────────────────────
# CATATAN TLS Trino: sertifikat Trino (self-signed) punya SAN
# `localhost / trino / sicabe-trino / trino-coordinator / 127.0.0.1`. Dari
# container, `host.docker.internal` TIDAK ada di SAN → verifikasi TLS gagal.
# Pilihan:
#   (a) pakai `network_mode: host` (lihat docker-compose.yml) → 127.0.0.1 cocok;
#   (b) tambah alias di extra_hosts yang ADA di SAN (mis. `sicabe-trino`), lalu
#       set TRINO_URL=https://sicabe-trino:12443
TRINO_URL=https://host.docker.internal:12443
TRINO_WEB_URL=http://localhost:12443
# CA diambil otomatis via config-agent (`/ca`) → tak perlu file lokal.

NESSIE_URL=http://host.docker.internal:12120

AIRFLOW_URL=http://host.docker.internal:12082
STARROCKS_HOST=host.docker.internal
STARROCKS_PORT=12930
STARROCKS_WEB_URL=http://localhost:12030

OPENMETADATA_URL=http://host.docker.internal:12085
GRAFANA_URL=http://host.docker.internal:12300
MINIO_CONSOLE_URL=http://localhost:12901

# Dremio (bila ada)
#DREMIO_URL=http://host.docker.internal:12947

# ── Runtime state (di dalam volume panel-data) ───────────────────────────────
SICABE_CONFIG_FILE=data/config.json
SICABE_STATE_FILE=data/state.json
SICABE_COMPOSE_PROJECTS=sicabe