# App identity
APP_NAME=Headquarter
ROOT_DOMAIN=localhost
TOOL_DOMAIN=tools.localhost

# API / Web URLs
API_URL=http://localhost:8000
WEB_URL=http://localhost:5173
CORS_ORIGINS=http://localhost:5173

# Database (local development)
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=headquarter
# DATABASE_URL uses a literal value because Pydantic Settings does not expand
# shell-style variable interpolation from .env files.
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/headquarter

# Authentik OIDC placeholders (wire in FN-004)
AUTHENTIK_ISSUER_URL=https://auth.example.com/application/o/headquarter/
AUTHENTIK_CLIENT_ID=your-client-id
AUTHENTIK_CLIENT_SECRET=your-client-secret

# Traefik / deployment placeholders (wire in FN-006)
TRAEFIK_NETWORK=traefik
TRAEFIK_ENTRYPOINT=websecure
TRAEFIK_CERT_RESOLVER=letsencrypt
TOOL_SUBDOMAIN_PATTERN={tool}-{project}-{user}.tools.localhost

# Frontend build-time variables (passed to web container)
VITE_API_URL=http://localhost:8000
VITE_OIDC_ISSUER=https://auth.example.com/application/o/headquarter/
VITE_OIDC_CLIENT_ID=your-client-id

# Secrets (generate strong random values for production)
SECRET_ENCRYPTION_KEY=change-me-in-production

# Auth dev bypass (local development only — NEVER enable in production)
AUTH_DEV_BYPASS=false