# Copy this to /mnt/user/appdata/velodrome/.env on the Unraid host and fill in real values.
# Never commit the real .env — only this example, with placeholders, belongs in git.

# --- Postgres superuser (used to create the `velodrome_app`/`velodrome_auth` roles at migration
# time, and as the container's own POSTGRES_PASSWORD; never held by the long-running api process) ---
POSTGRES_SUPERUSER_PASSWORD=changeme-superuser

# --- Per-role app passwords (used to build the DSNs below) ---
VELODROME_DB_APP_PASSWORD=changeme-app
VELODROME_DB_AUTH_PASSWORD=changeme-auth

# --- DSNs. `db` is the in-compose-network hostname of the `db` service (not localhost, not the
# host's IP) — Docker's embedded DNS resolves it for any container on the same compose network. ---
VELODROME_DATABASE_URL_APP=postgresql+asyncpg://velodrome_app:changeme-app@db:5432/velodrome
VELODROME_DATABASE_URL_AUTH=postgresql+asyncpg://velodrome_auth:changeme-auth@db:5432/velodrome
# VELODROME_DATABASE_URL_MIGRATE is deliberately NOT set here. It's the Postgres superuser DSN,
# used only for the one-off `alembic upgrade head` step in deploy.yml, passed as an inline `-e`
# override built from POSTGRES_SUPERUSER_PASSWORD above. The long-running api service never gets
# it. See apps/api/README.md's "Why two database connections".

# --- App settings ---
# Not yet used by anything (arrives with Bryton credential encryption in a later phase) — declared
# now so the settings shape is stable. Generate with e.g. `openssl rand -hex 32`.
VELODROME_SECRET_KEY=changeme-secret-key
VELODROME_ENVIRONMENT=production
# Must exactly match how the app is actually reached — it's compared against the request's Origin
# header on cookie-authenticated mutations (CSRF check; see velodrome/auth/dependencies.py). If
# this doesn't match byte-for-byte how a browser reaches the app, authenticated POST/PUT/DELETE
# requests will be rejected.
VELODROME_PUBLIC_URL=http://192.168.0.103:8090

# --- Image tag to deploy. release.yml pushes both the git ref name and `latest`; deploy.yml's
# `tag` workflow_dispatch input picks which one to pull. ---
TAG=latest