# =============================================================================
# .env.docker.example — template for `docker compose --env-file .env.docker up`
#
# DO NOT COMMIT .env.docker. It contains real secrets.
# Usage:
#   cp .env.docker.example .env.docker
#   $EDITOR .env.docker
#   docker compose --env-file .env.docker up --build
#
# Variable names MUST match docker-compose.yaml ${VARIABLE} references.
# =============================================================================

# --- PostgreSQL (local container) ---------------------------------------------
POSTGRES_USER=crm_user
# Generate a strong password, e.g.:
#   python -c "import secrets; print(secrets.token_urlsafe(24))"
DB_PASSWORD=STRONG_PASSWORD_HERE
POSTGRES_DB=crm_db

# --- Redis (REQUIRED) ---------------------------------------------------------
# Generate a strong password:
#   python -c "import secrets; print(secrets.token_urlsafe(24))"
REDIS_PASSWORD=STRONG_REDIS_PASSWORD_HERE

# --- SECRET_KEY (REQUIRED, min 32 chars) -------------------------------------
# Session signing secret. MUST be at least 32 characters.
# Generate with:
#   python -c "import secrets; print(secrets.token_urlsafe(48))"
SECRET_KEY=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx

# --- Domain / Frontend URL ----------------------------------------------------
# The public URL where users access the LeoCRM frontend.
# Used for password reset links, invitations, CORS, etc.
APP_DOMAIN=https://crm.example.com
FRONTEND_URL=https://crm.example.com
CORS_ORIGINS=https://crm.example.com

# --- Environment --------------------------------------------------------------
ENVIRONMENT=production
LOG_LEVEL=INFO
SESSION_COOKIE_SECURE=true
STORAGE_PATH=/data/storage

# --- SMTP (for password reset emails) -----------------------------------------
SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USERNAME=noreply@example.com
SMTP_PASSWORD=YOUR_SMTP_PASSWORD
SMTP_FROM_EMAIL=noreply@example.com
SMTP_USE_TLS=true

# --- bcrypt tuning ----------------------------------------------------------
BCRYPT_ROUNDS=12

# --- Admin user (seeded on first start) --------------------------------------
ADMIN_EMAIL=admin@example.com
ADMIN_PASSWORD=CHANGE_ME_generate_a_strong_password

# --- MAIL_ENCRYPTION_KEY (REQUIRED) -------------------------------------------
# AES-256 encryption key for mail account passwords (Fernet).
# Generate with:
#   python -c "import secrets; print(secrets.token_urlsafe(32))"
MAIL_ENCRYPTION_KEY=GENERATE_STRONG_KEY_HERE