# Host port the SPA is published on.
FRONTEND_PORT=5001

# Network-private Postgres container (see the `db` service in docker-compose.yml).
# These three initialise the database on the container's FIRST start (empty data
# dir only) — POSTGRES_USER becomes the superuser, POSTGRES_DB the default db.
POSTGRES_USER=postgres
POSTGRES_DB=postgres
POSTGRES_PASSWORD=CHANGE_ME_STRONG_DB_PASSWORD

# Backend → db connection. Host is the compose service name; no TLS because the
# traffic never leaves the internal club12 network (db publishes no host port).
# Username/Password MUST match POSTGRES_USER / POSTGRES_PASSWORD above.
# Required — the app throws at startup if missing.
ConnectionStrings__DbConnection=Host=db;Port=5432;Database=postgres;Username=postgres;Password=CHANGE_ME_STRONG_DB_PASSWORD;SSL Mode=Disable

# CORS. Unused in the proxy topology (same-origin) but the array must be non-null.
AllowedOrigins__0=https://localhost:5001

JWT__Key=CHANGE_ME_AT_LEAST_32_CHARS_LONG_SECRET
JWT__Issuer=Club12
JWT__Audience=Club12Client

Smtp__Host=smtp.example.com
Smtp__Port=587
Smtp__Username=CHANGE_ME
Smtp__Password=CHANGE_ME
Smtp__UseSsl=true          # optional, defaults true
Smtp__FromEmail=no-reply@example.com
Smtp__FromName=Club12

SupaBase__ProjectUrl=https://PROJECT.supabase.co
SupaBase__ServiceRole=CHANGE_ME_SERVICE_ROLE_KEY   # bad values hang startup (SupabaseHelper blocks in ctor)
SupaBase__BucketName=club12

AdminUser__Email=admin@example.com
AdminUser__Password=CHANGE_ME_STRONG_PASSWORD      # first-run seeding only

Frontend__MagicLinkUrl=https://localhost:5001/magic-link
Frontend__PasswordResetUrl=https://localhost:5001/reset-password

# Database backup/restore. Keep Enabled=false until the backup-data volume is
# confirmed mounted (see DEPLOYMENT.md phased rollout) — only then flip to true.
Backup__Enabled=false
Backup__IntervalHours=24
Backup__RetentionCount=7
Backup__StorageTarget=Local
Backup__LocalStoragePath=/app/backups
Backup__PgDumpPath=pg_dump
Backup__PsqlPath=psql