# Insight Updater - Environment Template
# Copy to .env and fill in secrets

# =============================================================================
# CORE APPLICATION
# =============================================================================
APP_ENV=development
SECRET_KEY=change-me-min-32-characters-random
ENCRYPTION_KEY=change-me-32-bytes-base64-encoded
JWT_ALGORITHM=RS256
JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
JWT_REFRESH_TOKEN_EXPIRE_DAYS=7

# =============================================================================
# DATABASE
# =============================================================================
# Development: SQLite (file-based, zero config)
DATABASE_URL=sqlite+aiosqlite:///./data/app.db

# Production: PostgreSQL (uncomment and configure)
# DATABASE_URL=postgresql+asyncpg://updater:secure-password@db:5432/insight_updater
DB_NAME=insight_updater
DB_USER=updater
DB_PASSWORD=change-me-db-password

# =============================================================================
# REDIS (for Socket.io pub/sub, caching, rate limiting)
# =============================================================================
REDIS_URL=redis://redis:6379/0

# =============================================================================
# WINRM CONFIGURATION
# =============================================================================
WINRM_TRANSPORT=ntlm          # ntlm | kerberos | credssp
WINRM_CERT_VALIDATION=ignore  # ignore | validate
WINRM_OPERATION_TIMEOUT=60
WINRM_READ_TIMEOUT=120
WINRM_KERBEROS_DELEGATION=true

# =============================================================================
# SSH CONFIGURATION
# =============================================================================
SSH_TIMEOUT=30
SSH_KEY_PATH=/app/keys/ssh_host_key  # optional host key for SSH server

# =============================================================================
# LDAP / ACTIVE DIRECTORY (STUB - prepared for future implementation)
# =============================================================================
LDAP_ENABLED=false
LDAP_URI=ldaps://dc.insight.local:636
LDAP_BIND_DN=CN=svc_updater,OU=Services,DC=insight,DC=local
LDAP_BIND_PASSWORD=
LDAP_USER_SEARCH_BASE=OU=Users,DC=insight,DC=local
LDAP_USER_FILTER=(sAMAccountName={username})
LDAP_GROUP_SEARCH_BASE=OU=Groups,DC=insight,DC=local
LDAP_GROUP_FILTER=(member={user_dn})
LDAP_CA_CERT_PATH=/app/certs/ldap-ca.pem

# =============================================================================
# FRONTEND (injected at build time via Vite)
# =============================================================================
VITE_API_URL=http://localhost:8000
VITE_WS_URL=ws://localhost:8000
VITE_APP_TITLE=Insight Updater

# =============================================================================
# LOGGING
# =============================================================================
LOG_LEVEL=INFO
LOG_FORMAT=json  # json | console

# =============================================================================
# DOCKER / DEPLOYMENT
# =============================================================================
COMPOSE_PROJECT_NAME=insight-updater
TRAEFIK_NETWORK=traefik-public
DOMAIN=updater.insight-it.de

# =============================================================================
# EXTERNAL SERVICES
# =============================================================================
# Vaultwarden (for CI/CD secrets)
VAULTWARDEN_URL=https://p.hartmannsche.cloud
# Gitea
GITEA_URL=https://gitea.insight-it.de
GITEA_REPO=b0rbor4d/insight-updater