# GoChat production variables. Copy to .env and replace every CHANGE_ME value.

GOCHAT_IMAGE_REF=git.ipao.vip/rogee/gochat@sha256:CHANGE_ME
GOCHAT_ENV=production
GOCHAT_PORT=3000
GOCHAT_SERVER_MODE=release
GOCHAT_SERVER_TRUSTED_PROXIES=10.0.0.0/8
# Optional local MaxMind-compatible City database mounted by production Compose.
# GOCHAT_GEOIP_DB_PATH=/run/gochat/geoip/GeoLite2-City.mmdb
# GOCHAT_GEOIP_DB_FILE=../../.secrets/GeoLite2-City.mmdb
GOCHAT_DATABASE_DSN=postgres://gochat:CHANGE_ME@db.CHANGE_ME.example.com:5432/gochat_production?sslmode=verify-full
GOCHAT_REDIS_DSN=redis://redis:6379/1

# Release mode requires external PostgreSQL and Redis endpoints. PostgreSQL must
# set exactly one sslmode: use disable only on a trusted private network, or use
# verify-ca/verify-full with the certificate settings below.
# Redis may omit authentication only on a trusted private Docker network. Use
# rediss:// with authentication when traffic crosses an untrusted network.
# Compose passes this value unchanged to every database client. Keep these fixed
# container paths in the DSN and point the host variables at untracked files.
# GOCHAT_DATABASE_DSN='postgres://user:pass@db.example.com:5432/gochat?sslmode=verify-full&sslrootcert=/run/secrets/external-db-ca.crt&sslcert=/run/secrets/external-db-client.crt&sslkey=/run/secrets/external-db-client.key'
# GOCHAT_DATABASE_TLS_CA_FILE=../../.secrets/external-db-ca.crt
# GOCHAT_DATABASE_TLS_CLIENT_CERT_FILE=../../.secrets/external-db-client.crt
# GOCHAT_DATABASE_TLS_CLIENT_KEY_FILE=../../.secrets/external-db-client.key
# Set all three files to this group and grant group read permission (0640 is
# suitable for the private key). Compose adds the group to every DB client.
# GOCHAT_DATABASE_TLS_GID=65534

MEILI_IMAGE_REF=getmeili/meilisearch:v1.13@sha256:bed3fb650e62da53145777204891159242f6ea4ce69e215b36223af4aa64a0ae

MEILI_MASTER_KEY=CHANGE_ME
GOCHAT_JWT_SECRET=CHANGE_ME_WITH_AT_LEAST_32_RANDOM_CHARACTERS
# Optional during a bounded rotation window; comma-separated old 32+ byte secrets.
GOCHAT_JWT_PREVIOUS_SECRETS=
GOCHAT_JWT_ALLOW_INSECURE_HEADER_AUTH=false
GOCHAT_JWT_ACCESS_EXPIRY_MINUTES=15
GOCHAT_JWT_REFRESH_EXPIRY_HOURS=168
GOCHAT_JWT_WS_TICKET_TTL_SECONDS=30

# Generate with: openssl rand -base64 32
GOCHAT_ENCRYPTION_ENABLED=true
GOCHAT_ENCRYPTION_CURRENT_KEY_VERSION=1
GOCHAT_ENCRYPTION_AES_KEY=CHANGE_ME

# Alertmanager reads the HTTPS receiver from this untracked one-line file.
ALERTMANAGER_WEBHOOK_URL_FILE=../../.secrets/alertmanager-webhook-url
PROMETHEUS_PORT=9090
ALERTMANAGER_PORT=9093
PROMETHEUS_RETENTION=30d

# Optional connector. Supply the digest published by its release pipeline.
SHANGWUTONG_IMAGE_REF=ghcr.io/rogeecn/shangwutong@sha256:CHANGE_ME
GOCHAT_CONNECTOR_SERVICE_TOKEN=

# Backup paths. The off-site directory must be an existing external mount.
GOCHAT_BACKUP_DIR=./backups/local
GOCHAT_BACKUP_OFFSITE_DIR=/mnt/gochat-offsite
GOCHAT_BACKUP_OFFSITE_SOURCE=CHANGE_ME_TO_APPROVED_MOUNT_SOURCE
GOCHAT_BACKUP_OFFSITE_FSTYPE=CHANGE_ME_TO_APPROVED_MOUNT_TYPE
GOCHAT_BACKUP_PASSPHRASE_FILE=../../.secrets/backup-passphrase