# ==========================================
# Doktainer Docker Runtime Environment
# ==========================================

# /* -------------------------------- Runtime -------------------------------- */
NEXT_PUBLIC_PANEL_NAME=DOKTAINER
NEXT_PUBLIC_VERSION=v0.2.4
NEXT_PUBLIC_BATCH=Batch-20260913
NEXT_PUBLIC_API_PORT=4000

# Leave NEXT_PUBLIC_API_URL empty/unset in monolith Docker deployment so the
# browser uses same-origin /api/v1 and Next proxies it to the backend.
# NEXT_PUBLIC_API_URL=http://localhost:4000/api/v1

# Optional frontend-only explicit override. If set, it wins over FRONTEND_URL
# for app-side public URL generation.
# NEXT_PUBLIC_PANEL_URL=https://panel.example.com

# /* --------------- Connection settings for PostgreSQL database -------------- */
POSTGRES_DB=doktainer
POSTGRES_USER=doktainer
POSTGRES_PASSWORD=doktainerdb
POSTGRES_PORT=5432

DATABASE_URL=postgresql://doktainer:doktainerdb@postgres:5432/doktainer?schema=public

# /* ------------------------------- App server ------------------------------ */
NODE_ENV=production

# Browser authentication in this production configuration requires HTTPS.
# Plain HTTP remains supported only by the local development configuration.

# Bind address for the backend process inside the container.
# This is NOT a public URL and must not be reused as FRONTEND_URL or NEXT_PUBLIC_PANEL_URL.
HOST=0.0.0.0
PORT=4000

SESSION_ABSOLUTE_TIMEOUT_HOURS=168

# Required in production. Generate once, store securely, and keep it stable:
# openssl rand -hex 32
# Changing this value without re-encrypting stored secrets makes existing
# credentials and deployment rollback snapshots unreadable.
ENCRYPTION_KEY=dev-32-char-encryption-key-here!

# /* -------------------------- Public URL / callbacks ------------------------ */
# Public URL priority for absolute links and OAuth callbacks:
# 1. NEXT_PUBLIC_PANEL_URL
# 2. FRONTEND_URL
# 3. Request origin from X-Forwarded-Host / X-Forwarded-Proto (or Host / protocol)
# 4. Browser origin for client-side usage
# 5. Fallback http://localhost:3000 only when no runtime origin is available
#
# In Docker deployments behind a reverse proxy, you can leave both values unset and let Doktainer
# derive the public origin dynamically from the current request.
#
# Set FRONTEND_URL only when you want to force one canonical public URL for generated absolute links
# such as invite URLs, Git provider callbacks, and settings reset defaults.
# Use a real public IP/domain only. Never set FRONTEND_URL to 0.0.0.0, ::, localhost, or a Docker-only host.

# FRONTEND_URL=https://panel.example.com

# /* -------------------------- Reverse proxy / CORS -------------------------- */
# When Doktainer sits behind Nginx, Traefik, Caddy, Cloudflare Tunnel, or another reverse proxy,
# set TRUST_PROXY=true so Fastify trusts forwarded host/protocol headers.

# TRUST_PROXY=true

# Optional comma-separated extra origins when the backend is exposed directly and CORS must allow them.
# Keep this explicit for security; this is not auto-derived from request origin.

# CORS_ORIGINS=https://panel.example.com

# Optional internal backend URL used by Next rewrites in monolith mode.
# This is internal-only and separate from the public panel URL above.

INTERNAL_API_URL=http://127.0.0.1:4000

# /* ------------------------- Docker image / compose ------------------------- */
# Optional image and compose naming overrides

COMPOSE_PROJECT_NAME=Doktainer
# DOKTAINER_IMAGE=doktainer:local
# DOKTAINER_IMAGE=ghcr.io/doktainer/doktainer:latest
# DOKTAINER_LOCAL_IMAGE=doktainer:local
# POSTGRES_IMAGE=postgres:16-alpine
# FRONTEND_PORT=3000
# BACKEND_PORT=4000