server:
  host: "0.0.0.0"
  port: 3000
  mode: "debug"  # debug, release, test
  cors:
    allowed_origins: []  # empty = Allow-Origin:* in debug mode; production must list exact origins
    # Examples:
    #   - "https://app.example.com"
    #   - "*.example.com"
    allowed_methods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"]
    allowed_headers: ["Origin", "Content-Type", "Accept", "Authorization", "X-Account-ID", "access-token", "client", "uid", "token-type", "expiry"]
    expose_headers: ["Content-Length", "access-token", "client", "uid", "token-type", "expiry"]
    allow_credentials: false  # set to true only if you need cookies/auth headers
    max_age: 86400  # preflight cache duration in seconds

database:
  host: "localhost"
  port: 5444
  user: "postgres"
  password: "xiha02"
  name: "gochat_dev"
  dbname: "gochat_dev"
  sslmode: "disable"
  max_idle_conns: 10
  max_open_conns: 100
  conn_max_lifetime: 3600  # seconds
  run_migrations: true      # auto-run migrations on startup (dev convenience)
  migrations_path: "migrations"

redis:
  url: "redis://:xiha02@localhost:6397/0"
  host: "localhost"
  port: 6397
  password: "xiha02"
  db: 0
  pool_size: 50

jwt:
  secret: "gochat_dev_secret_change_in_production"
  expiry_hours: 72

log:
  level: "debug"  # debug, info, warn, error
  format: "json"  # json, text

rate_limit:
  enabled: true
  requests_per_minute: 100  # max requests per client IP per window
  window_seconds: 60        # sliding window duration in seconds

search:
  # Chatwoot parity target. Use "db" only for explicit local fallback.
  engine: "meilisearch"
  host: "http://localhost:7700"
  api_key: ""
  index_prefix: "gochat_"
  timeout_seconds: 5

saml:
  enabled: false  # SAML 2.0 SSO — enable for enterprise IdP integration
  # IdP metadata: provide URL or inline XML (URL preferred for auto-refresh)
  idp_metadata_url: ""       # e.g. "https://idp.example.com/metadata"
  idp_metadata_xml: ""       # fallback: paste IdP metadata XML here
  sp_entity_id: "https://gochat.example.com/saml"  # our SP entity ID
  acs_url: "https://gochat.example.com/api/v1/saml/acs"  # Assertion Consumer Service URL
  # SP key/certificate: PEM format (required for signed AuthnRequest + response validation)
  sp_private_key: ""         # path or inline PEM — generate with: openssl genrsa -out sp.key 2048
  sp_certificate: ""         # path or inline PEM — generate with: openssl req -new -x509 -key sp.key -out sp.crt
  clock_drift_tolerance: 180  # seconds of allowed clock drift for NotOnOrAfter validation
  attribute_map:
    email: "email"            # SAML attribute → GoChat email field
    display_name: "displayName"  # SAML attribute → GoChat display name field
    first_name: "firstName"    # SAML attribute → first name component
    last_name: "lastName"     # SAML attribute → last name component

# Captain AI + Copilot feature configuration
# Reference: Chatwoot config/features.yml + ENV variables for Captain
# Secrets (llm_api_key) should be injected via .env: GOCHAT_CAPTAIN_LLM_API_KEY
captain:
  enabled: true
  llm_provider: "openai"          # openai, azure, custom
  llm_model: "gpt-4o-mini"        # gpt-4o, gpt-3.5-turbo, etc.
  llm_api_key: ""                 # inject via GOCHAT_CAPTAIN_LLM_API_KEY in .env
  llm_base_url: "https://api.openai.com/v1"  # custom endpoint for domestic providers
  embedding_model: "text-embedding-3-small"
  embedding_dims: 1536
  max_tokens: 1024
  temperature: 0.7