# Insight Updater - Environment Template (Zentrale)
# Copy to .env and fill in secrets
# Hinweis: WinRM/SSH/Credentials sind in den Satellite gewandert (satellite/config.yaml)

# =============================================================================
# CORE APPLICATION
# =============================================================================
APP_ENV=development
SECRET_KEY=change-me-min-32-characters-random
JWT_ALGORITHM=RS256
JWT_PRIVATE_KEY_PATH=/app/keys/private.pem
JWT_PUBLIC_KEY_PATH=/app/keys/public.pem
JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
JWT_REFRESH_TOKEN_EXPIRE_DAYS=7

# Initialer Admin (nur beim ersten Start, wenn keine User existieren)
ADMIN_INITIAL_PASSWORD=admin

# =============================================================================
# DATABASE
# =============================================================================
# Development: SQLite (file-based, zero config)
DATABASE_URL=sqlite+aiosqlite:///./data/app.db

# Production: PostgreSQL
# DATABASE_URL=postgresql+asyncpg://updater:secure-password@db:5432/insight_updater
DB_NAME=insight_updater
DB_USER=updater
DB_PASSWORD=change-me-db-password

# =============================================================================
# JOBS
# =============================================================================
# Sekunden ohne Satellite-Report, bevor ein claimed/running Job als failed gilt
JOB_STALE_TIMEOUT=3600

# =============================================================================
# LDAP / ACTIVE DIRECTORY (STUB - prepared for future implementation)
# =============================================================================
LDAP_ENABLED=false
LDAP_URI=ldaps://dc.insight.local:636
LDAP_BIND_DN=CN=svc_updater,OU=Services,DC=insight,DC=local
LDAP_BIND_PASSWORD=
LDAP_USER_SEARCH_BASE=OU=Users,DC=insight,DC=local
LDAP_USER_FILTER=(sAMAccountName={username})

# =============================================================================
# FRONTEND (injected at build time via Vite)
# =============================================================================
VITE_API_URL=http://localhost:8000
VITE_APP_TITLE=Insight Updater

# =============================================================================
# LOGGING
# =============================================================================
LOG_LEVEL=INFO
LOG_FORMAT=json  # json | console

# =============================================================================
# DOCKER / DEPLOYMENT
# =============================================================================
COMPOSE_PROJECT_NAME=insight-updater
TRAEFIK_NETWORK=traefik-public
DOMAIN=updater.insight-it.de

# =============================================================================
# EXTERNAL SERVICES
# =============================================================================
VAULTWARDEN_URL=https://p.hartmannsche.cloud
GITEA_URL=https://gitea.insight-it.de
GITEA_REPO=b0rbor4d/insight-updater