# ─────────────────────────────────────────────────────────────────────────────
# sitomat control plane — copy to `docker/.env` and edit.
#   cp docker/env.example docker/.env
#
# (Named `env.example`, not `.env.example`, on purpose: the tooling policy in
# this repo blocks files matching `*.env*`. The copy target `docker/.env` IS
# gitignored and is excluded from the image build context.)
#
# SINGLE DOMAIN (Opsi A): the reverse proxy serves the web UI AND the API on ONE
# origin, split by path. See docs/deployment.md → "Docker" and the nginx
# template at docker/nginx/templates/default.conf.template.
# ─────────────────────────────────────────────────────────────────────────────

# ── REQUIRED ─────────────────────────────────────────────────────────────────
# Generate a fresh one — never reuse an example value:
#   openssl rand -base64 32
BETTER_AUTH_SECRET=aLNwbyLRHByb9T9DWFpR4Ck88WAk9kuMGXAwLu6eV6g=

# ── REGISTRY IMAGES ──────────────────────────────────────────────────────────
# Which images the DEPLOY file pulls. Set BOTH here on the build host (used by
# docker/build-push.sh) and on EVERY deploy host. Example:
#   SITOMAT_IMAGE_REGISTRY=registry.contoh.go.id/sitomat
#   SITOMAT_IMAGE_TAG=1.0.0
# Deploy host then only needs:  docker compose … pull  &&  docker compose … up -d
SITOMAT_IMAGE_REGISTRY=registry.sicabe.com/sitomat
SITOMAT_IMAGE_TAG=1.0.0

# ── PUBLIC ORIGIN — ONE domain for web + API (Opsi A) ────────────────────────
# Both values are the SAME single origin; the proxy splits it by path.
#   • no domain yet → server IP + proxy port, e.g. http://192.168.1.10:8080
#   • with TLS     → https://sitomat.contoh.go.id
# Exact origin: scheme + host + port, NO trailing slash.
#
# These are RUNTIME values (BETTER_AUTH_URL / WEB_URL) — change + `up -d` only.
API_PUBLIC_URL=http://localhost:8080
WEB_PUBLIC_URL=http://localhost:8080

# ── WEB API BASE (build-time) — LEAVE EMPTY ──────────────────────────────────
# Empty (recommended) = same-origin: the browser client resolves the API against
# `window.location.origin` and download links are relative, so the web image is
# DOMAIN-AGNOSTIC — changing the public domain needs NO rebuild.
# Set an absolute origin ONLY for the two-domain (split) setup; then a domain
# change requires:  docker compose … build web  &&  docker compose … up -d web
WEB_API_BASE_URL=

# ── HOST PORTS (optional) ────────────────────────────────────────────────────
# The single public entry is the PROXY. The api/web ports are for direct
# debugging only — the proxy reaches them on the compose network.
API_PORT=13000
WEB_PORT=13001
PROXY_PORT=8080

# ── SESSION COOKIE DOMAIN — leave EMPTY in single-domain mode ────────────────
# One origin ⇒ host-only cookie, which is exactly right. Set this ONLY if you
# deliberately put the web and API on DIFFERENT subdomains (not Opsi A).
#SESSION_COOKIE_DOMAIN=

# ── KEYCLOAK SSO (optional) ──────────────────────────────────────────────────
# Leave ALL THREE empty to disable Keycloak entirely. Setting OIDC_CLIENT_ID
# without OIDC_ISSUER_URL makes the API refuse to boot (fail fast).
#OIDC_CLIENT_ID=
#OIDC_CLIENT_SECRET=
#OIDC_ISSUER_URL=

# ── WEB BUILD FLAGS ──────────────────────────────────────────────────────────
# 🚨 NEXT_PUBLIC_DEMO_LOGIN must stay `false` on any server others can reach:
# `true` lets anyone sign in as any role WITHOUT a password.
NEXT_PUBLIC_DEMO_LOGIN=true
NEXT_PUBLIC_KEYCLOAK_ENABLED=false

# ── REVERSE PROXY (profile "proxy") ──────────────────────────────────────────
# The single hostname the proxy answers for (envsubst → nginx `server_name`).
# With a real domain: PUBLIC_HOST=sitomat.contoh.go.id
PUBLIC_HOST=localhost