# MealQuest production environment: the template for deploy/.env (never
# committed). The service fails fast: a missing or invalid required variable
# stops it at boot with the variable named. Creating deploy/.env: CTXD
# project mealquest, RUNBOOKS.MD "Stack and first deploy" > "3. Environment
# file".
#
# Secrets are never set here. They live in deploy/secrets/ (never committed),
# one value per file, owned by the container user 10001:10001 with mode
# 0600: secret_key, oidc_client_secret, google_client_secret and
# vapid_private_key. SearXNG's
# searxng.env is the exception: compose reads it itself, so it is owned by
# the host account that runs compose, mode 0600. Creating them: CTXD project
# mealquest, RUNBOOKS.MD "Stack and first deploy" > "4. Secrets".
#
# deploy/compose.yaml mounts them at /run/secrets/<name> and points the
# *_FILE variables at them.

# --- Compose -----------------------------------------------------------------

# Host address the service is published on, as <address>:8090. Production
# binds the LAN address 10.60.1.14 only; 127.0.0.1 suits a dev machine.
MEALQUEST_BIND_ADDRESS=127.0.0.1

# --- Service -----------------------------------------------------------------

# Public origin the household opens. Fixes the OIDC redirect URI
# (<url>/auth/callback) and the Secure cookies. Must be https:// (plain
# http:// is accepted only for localhost, 127.0.0.1 and [::1]).
MEALQUEST_PUBLIC_URL=https://mealquest.cubecraftlabs.com

# How long a graceful shutdown may take before in-flight requests are cut.
MEALQUEST_SHUTDOWN_TIMEOUT=10s

# Optional. Comma-separated IPs/CIDRs of reverse proxies whose
# X-Forwarded-For/-Proto headers are honoured. Production lists Traefik;
# unset trusts no peer.
MEALQUEST_TRUSTED_PROXY=10.60.1.33

# IANA zone the household settings are created with on first boot. Required
# until those settings exist; ignored afterwards (change the zone in
# household settings instead).
MEALQUEST_DEFAULT_TZ=America/New_York

# --- Authentik OIDC ----------------------------------------------------------

# Issuer of the Authentik application "mealquest". Discovered at boot, so it
# must be reachable from the container. Must be https://.
MEALQUEST_OIDC_ISSUER=https://auth.cubecraftlabs.com/application/o/mealquest/
MEALQUEST_OIDC_CLIENT_ID=mealquest
# Comma-separated Authentik groups whose members may sign in.
MEALQUEST_OIDC_ALLOWED_GROUPS=mealquest-admin

# --- Google Calendar (Push to Calendar) ------------------------------------

# Client ID of the Google OAuth web client (CTXD project mealquest,
# RUNBOOKS.MD "Google Calendar OAuth client"). Required: the service will
# not start without it and the client secret file. Its authorized redirect
# URI is <MEALQUEST_PUBLIC_URL origin>/api/v1/integrations/google/callback.
MEALQUEST_GOOGLE_CLIENT_ID=<client id>.apps.googleusercontent.com

# --- Web Push (VAPID) ------------------------------------------------------

# Required: the service will not start without the public key, the subject
# and the private key file, or with a private key that does not belong to
# the public key. `go run ./cmd/vapidgen` prints a new pair: its
# MEALQUEST_VAPID_PUBLIC_KEY line goes here, its private key line alone
# into deploy/secrets/vapid_private_key. Both are unpadded base64url P-256
# keys. Key pair: CTXD project mealquest, RUNBOOKS.MD "VAPID keys (Web
# Push)". Replacing the pair invalidates every browser's subscription.
MEALQUEST_VAPID_PUBLIC_KEY=<base64url VAPID public key>
# The push services' contact for this sender: mailto:<address> or https://.
MEALQUEST_VAPID_SUBJECT=mailto:<owner address>

# Optional session lifetimes. A session ends after IDLE unused and always MAX
# after sign-in; MAX must be at least IDLE. Defaults: 720h and 4320h.
MEALQUEST_SESSION_IDLE=720h
MEALQUEST_SESSION_MAX=4320h

# --- Set by deploy/compose.yaml; do not set here -----------------------------
#
# MEALQUEST_HTTP_ADDR=:8080
# MEALQUEST_DATA_DIR=/data
# MEALQUEST_SECRET_KEY_FILE=/run/secrets/secret_key
#   Base64 of 32 random bytes; encrypts secrets at rest (AES-256-GCM).
# MEALQUEST_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
#   The Authentik provider's client secret.
# MEALQUEST_GOOGLE_CLIENT_SECRET_FILE=/run/secrets/google_client_secret
#   The Google OAuth web client's secret.
# MEALQUEST_VAPID_PRIVATE_KEY_FILE=/run/secrets/vapid_private_key
#   The VAPID private key printed by `go run ./cmd/vapidgen`.
# MEALQUEST_SEARXNG_URL=http://searxng:8080
#   The SearXNG recipe-search sidecar on the compose network. The Settings
#   screen pre-fills it as the SearXNG URL until one is saved; the saved
#   provider and base URL come from PATCH /api/v1/settings/recipe-search.
#   See CTXD project mealquest, RUNBOOKS.MD "Recipe search (SearXNG)".