# /etc/chatapp/env  (production)
#
# This file is loaded by systemd's EnvironmentFile= (see
# deploy/systemd/chatapp.service) directly into the app process's
# environment -- it is NOT a dotenv file Python reads from a working
# directory, and it must never be committed to the repository.
#
# Install:
#   sudo mkdir -p /etc/chatapp
#   sudo cp deploy/chatapp.env.example /etc/chatapp/env
#   sudo chown root:chatapp /etc/chatapp/env
#   sudo chmod 0640 /etc/chatapp/env
#   # then edit in the real values below
#
# See ../DEPLOYMENT.md for how each value is generated.

# Points at the data server's PRIVATE address -- never the public one.
# The role/password here are whatever you created on the data server in
# DEPLOYMENT.md step 2.
DATABASE_URL=postgresql+asyncpg://chatapp:REPLACE_ME@<DATA_SERVER_PRIVATE_IP>:5432/chatapp

# Generate with: python3 -c "import secrets; print(secrets.token_urlsafe(32))"
SESSION_SECRET=REPLACE_ME

# true in production -- cookies are only sent over HTTPS. The local dev
# default (backend/.env.example) is false because dev runs over plain HTTP.
SESSION_HTTPS_ONLY=true

# Matches the requirepass set in /etc/redis/redis.conf on the data server
# (see DEPLOYMENT.md step 2). Same private-address rule as DATABASE_URL.
REDIS_URL=redis://:REPLACE_ME@<DATA_SERVER_PRIVATE_IP>:6379/0

# Optional: push notifications are silently skipped if these are unset.
# Generate with: .venv/bin/python -m app.cli generate-vapid-keys
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=mailto:you@example.com