# shopdb-flask environment template.
#
# Copy to .env and fill in the values. .env is gitignored. ProductionConfig
# refuses to boot when SECRET_KEY, JWT_SECRET_KEY, DATABASE_URL, or
# CORS_ORIGINS are missing or use the dev defaults.
#
# See docs/DEPLOY.md for the full per-site deployment runbook.

# ---- Flask ----
FLASK_APP=wsgi.py

# Set to 'production' for live sites. Other valid values: 'development',
# 'testing'. Production triggers ProductionConfig.validate() at boot.
FLASK_ENV=production

# ---- Required secrets (production refuses to boot without these) ----

# Generate strong random values, e.g.:
#   python -c "import secrets; print(secrets.token_urlsafe(64))"
SECRET_KEY=change-this-to-a-secure-random-string
JWT_SECRET_KEY=change-this-to-another-secure-random-string

# ---- Database (required) ----

# Format: mysql+pymysql://<user>:<password>@<host>:<port>/<database>
# In docker-compose, host is `db` (the service name).
DATABASE_URL=mysql+pymysql://shopdb:CHANGE_ME@db:3306/shopdb_flask

# ---- CORS (required, no wildcards in production) ----

# Comma-separated list of explicit origins permitted to call the API.
# Example for a single-host facility deploy:
#   CORS_ORIGINS=https://shopdb.facility-a.example.com
# Wildcard '*' is rejected by ProductionConfig.validate().
CORS_ORIGINS=http://localhost:5173

# ---- JWT lifecycle (optional, defaults shown) ----
JWT_ACCESS_TOKEN_EXPIRES=3600
JWT_REFRESH_TOKEN_EXPIRES=2592000

# ---- Logging (optional) ----
LOG_LEVEL=INFO

# ---- docker-compose only ----
# These are read by docker-compose.yml; not used by the Flask app directly.
MYSQL_ROOT_PASSWORD=CHANGE_ME_ROOT_PASSWORD
MYSQL_PASSWORD=CHANGE_ME_APP_PASSWORD
MYSQL_PORT=3306
API_PORT=5001

# ---- Zabbix integration (optional, for printer supply monitoring) ----
ZABBIX_URL=
ZABBIX_TOKEN=

# ---- Per-plugin collector API keys (optional) ----
# Per ADR-006, each plugin can accept external collector input at
# /api/collector/<pluginname>. The framework checks
# COLLECTOR_API_KEY_<PLUGINNAME> first, then COLLECTOR_API_KEY as fallback.
# COLLECTOR_API_KEY=
# COLLECTOR_API_KEY_COMPUTERS=