# Production compose secrets — copy to .env.prod (never commit).
#   ./scripts/compose-prod.sh up -d --build

POSTGRES_USER=pargar
POSTGRES_DB=pargar
POSTGRES_PASSWORD=replace-with-strong-postgres-password
REDIS_PASSWORD=replace-with-strong-redis-password
RUSTFS_ACCESS_KEY=replace-with-rustfs-access-key
RUSTFS_SECRET_KEY=replace-with-long-rustfs-secret
STORAGE_REGION=us-east-1
STORAGE_BUCKET=pargar
JWT_SECRET=replace-with-at-least-32-random-characters
ADMIN_PASSWORD=replace-with-strong-admin-password
ADMIN_NAME=Admin
ADMIN_USERNAME=admin
ADMIN_EMAIL=admin@example.com

# Public DNS hostname (Let's Encrypt HTTP-01 must reach this host on :80)
DOMAIN=app.example.com
ACME_EMAIL=ops@example.com
PUBLIC_URL=https://app.example.com
FRONTEND_ORIGINS=https://app.example.com

DEV_MODE=false
SEED_CURRICULUM=false
# Keep false behind NAT until the edge forwards real client IPs.
REGISTRATION_ENFORCE_IP=false
METRICS_TOKEN=replace-with-metrics-scrape-token
# TRUSTED_PROXY_CIDRS=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

DONATION_ENABLED=true
# Enable only when offline payment ops are ready.
PHYSICAL_CERT_ENABLED=false
PHYSICAL_CERT_PRICE_IRR=2500000
PHYSICAL_CERT_WINDOW_DAYS=30