# =============================================================================
# .env.docker.example — template for `docker compose --env-file .env.docker up`
#
# DO NOT COMMIT .env.docker. It contains real secrets.
# Usage:
#   cp .env.docker.example .env.docker
#   $EDITOR .env.docker
#   docker compose --env-file .env.docker up --build
# =============================================================================

# --- PostgreSQL (local container) ---------------------------------------------
POSTGRES_USER=crm_user
# Generate a strong password, e.g.:
#   python -c "import secrets; print(secrets.token_urlsafe(24))"
POSTGRES_PASSWORD=STRONG_PASSWORD_HERE
POSTGRES_DB=crm_db

# --- CRM Application ----------------------------------------------------------
# The host "postgres" is the docker-compose service name (internal DNS).
# The DRIVER is asyncpg for production PostgreSQL.
DATABASE_URL=postgresql+asyncpg://crm_user:STRONG_PASSWORD_HERE@postgres:5432/crm_db

# --- AUTH_SECRET (REQUIRED, min 32 chars) ------------------------------------
# JWT signing secret. MUST be at least 32 characters.
# Generate with:
#   python -c "import secrets; print(secrets.token_urlsafe(48))"
AUTH_SECRET=MIN_32_CHARS_GENERATE_WITH_secrets_token_urlsafe_32_xxxxxxxxxxxx

# --- CORS / environment -------------------------------------------------------
# Comma-separated, NO wildcards. In dev we allow localhost:8000 (the app) and
# :5173 (e.g. Vite dev server). In production, restrict to the real domain.
CORS_ORIGINS=http://localhost:8000,http://localhost:5173
ENVIRONMENT=production
LOG_LEVEL=INFO

# --- JWT / bcrypt tuning (keep aligned with .env.example) ---------------------
JWT_ALGORITHM=HS256
JWT_EXPIRY_HOURS=24
BCRYPT_ROUNDS=12