# MealQuest production environment. Copy to deploy/.env (never committed)
# and replace the placeholders. The service fails fast: a missing or invalid
# required variable stops it at boot with the variable named.
#
# Secrets are never set here. They live in deploy/secrets/ (never committed),
# one value per file, owned by the container user and readable only by it:
#
#   mkdir -p deploy/secrets && chmod 700 deploy/secrets
#   head -c 32 /dev/urandom | base64 > deploy/secrets/secret_key
#   printf '%s\n' '<Authentik client secret>' > deploy/secrets/oidc_client_secret
#   sudo chown 10001:10001 deploy/secrets/* && sudo chmod 600 deploy/secrets/*
#
# SearXNG's secret key is the exception: compose reads it itself, so it
# stays owned by you (mode 0600). Create it after the chown above:
#
#   (umask 077; printf 'SEARXNG_SECRET=%s\n' "$(openssl rand -hex 32)" > deploy/secrets/searxng.env)
#
# deploy/compose.yaml mounts them at /run/secrets/<name> and points the
# *_FILE variables at them.

# --- Compose -----------------------------------------------------------------

# Host address the service is published on, as <address>:8090. Production
# binds the LAN address 10.60.1.14 only; 127.0.0.1 suits a dev machine.
MEALQUEST_BIND_ADDRESS=127.0.0.1

# --- Service -----------------------------------------------------------------

# Public origin the household opens. Fixes the OIDC redirect URI
# (<url>/auth/callback) and the Secure cookies. Must be https:// (plain
# http:// is accepted only for localhost, 127.0.0.1 and [::1]).
MEALQUEST_PUBLIC_URL=https://mealquest.cubecraftlabs.com

# How long a graceful shutdown may take before in-flight requests are cut.
MEALQUEST_SHUTDOWN_TIMEOUT=10s

# Optional. Comma-separated IPs/CIDRs of reverse proxies whose
# X-Forwarded-For/-Proto headers are honoured. Production lists Traefik;
# unset trusts no peer.
MEALQUEST_TRUSTED_PROXY=10.60.1.33

# IANA zone the household settings are created with on first boot. Required
# until those settings exist; ignored afterwards (change the zone in
# household settings instead). Confirm the household's zone before the first
# deploy.
MEALQUEST_DEFAULT_TZ=America/New_York

# --- Authentik OIDC ----------------------------------------------------------

# Issuer of the Authentik application "mealquest". Discovered at boot, so it
# must be reachable from the container. Must be https://.
MEALQUEST_OIDC_ISSUER=https://auth.cubecraftlabs.com/application/o/mealquest/
MEALQUEST_OIDC_CLIENT_ID=mealquest
# Comma-separated Authentik groups whose members may sign in.
MEALQUEST_OIDC_ALLOWED_GROUPS=mealquest-admin

# Optional session lifetimes. A session ends after IDLE unused and always MAX
# after sign-in; MAX must be at least IDLE. Defaults: 720h and 4320h.
MEALQUEST_SESSION_IDLE=720h
MEALQUEST_SESSION_MAX=4320h

# --- Set by deploy/compose.yaml; do not set here -----------------------------
#
# MEALQUEST_HTTP_ADDR=:8080
# MEALQUEST_DATA_DIR=/data
# MEALQUEST_SECRET_KEY_FILE=/run/secrets/secret_key
#   Base64 of 32 random bytes; encrypts secrets at rest (AES-256-GCM).
# MEALQUEST_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
#   The Authentik provider's client secret.
# MEALQUEST_SEARXNG_URL=http://searxng:8080
#   The SearXNG recipe-search sidecar on the compose network. The Settings
#   screen pre-fills it as the SearXNG URL until one is saved; the saved
#   provider and base URL come from PATCH /api/v1/settings/recipe-search.
#   See deploy/RUNBOOK.md "Recipe search (SearXNG)".

# --- Planned; not read by the service yet -------------------------------------
#
# Added to deploy/compose.yaml and this file by the features that use them.
#
# Web Push (Feature 19). Generate the key pair with cmd/vapidgen.
# MEALQUEST_VAPID_PUBLIC_KEY=<base64url VAPID public key>
# MEALQUEST_VAPID_PRIVATE_KEY_FILE=/run/secrets/vapid_private_key
# MEALQUEST_VAPID_SUBJECT=mailto:<owner address>
#
# Google Calendar OAuth web client (Feature 16).
# MEALQUEST_GOOGLE_CLIENT_ID=<client id>.apps.googleusercontent.com
# MEALQUEST_GOOGLE_CLIENT_SECRET_FILE=/run/secrets/google_client_secret