# Production configuration for deploy/compose.yml + compose.prod.yml.
# Copy to deploy/.env.prod, then:
#
#   1. replace every `*.example.com` with your actual domains (each service
#      below has its own, independent domain — they don't need to share a
#      root, e.g. for DNS providers that don't allow multi-level
#      subdomains),
#   2. replace every CHANGE_ME with a strong random value
#      (`openssl rand -hex 24`),
#   3. point each domain below at the server and add its vhost to the shared
#      edge (Infrastructure's edge/conf.d).
#
# Requires ../../../Infrastructure running first, on the same Docker host,
# with its own `infra-net` network already created. See
# ../../../Infrastructure/README.md. Not versioned. Keep it readable only by
# the deploy user (chmod 600).

DOTNET_ENVIRONMENT=Production

# --- Domains -------------------------------------------------------------
# Public URLs. They must match the vhosts of the shared edge nginx
# (Infrastructure's edge/conf.d), which is what serves them; the domains are
# independent, they don't need to share a root.
PUBLIC_WEB_URL=https://musify.example.com
PUBLIC_API_URL=https://musifyapi.example.com
PUBLIC_STREAM_URL=https://musifystream.example.com
PUBLIC_AUTH_URL=https://auth.example.com
S3_PUBLIC_URL=https://s3.example.com

# --- PostgreSQL (Infrastructure's shared instance, Musify's own database) ---
# Musify's own role, owner of musify_db only.
POSTGRES_HOST=postgres
POSTGRES_USER=musify
# = Infrastructure's MUSIFY_DB_PASSWORD
POSTGRES_PASSWORD=CHANGE_ME
POSTGRES_DB=musify_db

# --- Zitadel (OIDC, shared instance) -----------------------------------------
# Folder with Musify's own Zitadel PAT, written by Infrastructure's `provision`.
ZITADEL_PAT_DIR=../../../Infrastructure/zitadel/.output/musify
ZITADEL_DEV_MODE=false

# OIDC clients: the zitadel-init one-shot service (see compose.yml) fills
# these in automatically on `docker compose up -d`.
AUTH_CLIENT_ID=
WEB_CLIENT_ID=
WEB_CLIENT_SECRET=

# --- RabbitMQ (shared instance, MassTransit) --------------------------------
RABBITMQ_HOST=rabbitmq
RABBITMQ_VHOST=musify
RABBITMQ_USER=musify
# = Infrastructure's MUSIFY_RABBITMQ_PASSWORD
RABBITMQ_PASSWORD=CHANGE_ME

# --- SeaweedFS (S3, shared instance, Musify's own bucket) --------------------
SEAWEEDFS_HOST=seaweedfs
# = Infrastructure's MUSIFY_S3_ACCESS_KEY / MUSIFY_S3_SECRET_KEY
S3_ACCESS_KEY=CHANGE_ME
S3_SECRET_KEY=CHANGE_ME
S3_BUCKET=webapi-storage
S3_INTERNAL_URL=http://seaweedfs:8333
S3_USE_HTTP=false

# --- Jaeger (shared instance, tracing) ---------------------------------------
JAEGER_HOST=jaeger

# --- Web player --------------------------------------------------------------
# Key material for the encrypted session cookie. Rotating it logs everyone out.
SESSION_SECRET=CHANGE_ME
AUTH_ALLOW_INSECURE_HTTP=false

# --- Misc --------------------------------------------------------------------
AUTH_REQUIRE_HTTPS=true