# Copy to .env and fill in real values before `docker compose -f docker-compose.prod.yaml up`.
# .env is gitignored -- never commit real secrets.

POSTGRES_USER=bridzik
POSTGRES_PASSWORD=bridzik
POSTGRES_DB=bridzik

# Comma-separated list of origins allowed to open a Socket.IO connection.
# Must be the public URL(s) the frontend is served from -- never "*" in prod.
CORS_ALLOWED_ORIGINS=https://bridzik.liptim.eu

# Shared secret for the self-hosted /api/admin/* stats endpoints.
ADMIN_TOKEN=tajneheslo

# pgAdmin login (UI bound to 127.0.0.1:8081 on the host -- access via SSH tunnel,
# never expose publicly since it has full access to the Postgres data).
PGADMIN_DEFAULT_EMAIL=admin@example.com
PGADMIN_DEFAULT_PASSWORD=zmen_ma

# Fernet key encrypting Player.totp_secret at rest. Generate with:
#   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# Keep it stable across restarts/redeploys -- losing it locks every account
# out (their TOTP secret can no longer be decrypted).
ENCRYPTION_KEY=

# Optional: IP -> country for /api/track pageviews (see GEOIP_DB_PATH in
# docker-compose.prod.yaml). Place a .mmdb file (GeoLite2-City/Country from a
# MaxMind account, or a DB-IP/IP2Location Lite equivalent) at
# ./geoip/GeoLite2-City.mmdb next to docker-compose.prod.yaml. Left missing ->
# country is just recorded as "".