# Production configuration for compose.yml (no overlay needed: the base
# file is already the production shape, with no published ports and
# everything reachable only on infra-net).
#
#   cp .env.prod.example .env.prod
#   chmod 600 .env.prod
#   docker compose --env-file .env.prod -f compose.yml up -d
#
# Replace every CHANGE_ME with a strong random value (`openssl rand -hex 24`;
# the Zitadel masterkey needs exactly 32 characters) and auth.example.com
# with the real hostname the shared edge (edge/) terminates TLS for.

# --- PostgreSQL ---------------------------------------------------------------
POSTGRES_USER=postgres
POSTGRES_PASSWORD=CHANGE_ME

# --- Zitadel (OIDC) ----------------------------------------------------------
ZITADEL_MASTERKEY=CHANGE_ME_32_CHARACTERS_EXACTLY_
ZITADEL_EXTERNAL_DOMAIN=auth.example.com
ZITADEL_EXTERNAL_PORT=443
ZITADEL_EXTERNAL_SECURE=true
ZITADEL_TLS_MODE=external
ZITADEL_PUBLIC_SCHEME=https
# Login V2 UI, routed by the edge under the same hostname. No trailing slash.
ZITADEL_LOGIN_BASE_URL=https://auth.example.com/ui/v2/login
ZITADEL_DATABASE_PASSWORD=CHANGE_ME
ZITADEL_ORG_NAME=Iker Demo
ZITADEL_ADMIN_USERNAME=admin@ikerdemo.cat
ZITADEL_ADMIN_FIRST_NAME=Iker Demo
ZITADEL_ADMIN_LAST_NAME=Admin
ZITADEL_ADMIN_DISPLAY_NAME=Iker Demo Admin
ZITADEL_ADMIN_PASSWORD=CHANGE_ME

# --- SeaweedFS (S3) ----------------------------------------------------------
S3_ACCESS_KEY=CHANGE_ME
S3_SECRET_KEY=CHANGE_ME

# --- RabbitMQ -----------------------------------------------------------------
RABBITMQ_DEFAULT_USER=CHANGE_ME
RABBITMQ_DEFAULT_PASS=CHANGE_ME