# beenvoice-web environment
#
# Local dev:  cp .env.example .env.local
# Docker:     cp .env.example .env
#
# Docker deploy checklist:
#   1. Set AUTH_SECRET, BETTER_AUTH_URL, NEXT_PUBLIC_APP_URL to your public URL
#   2. docker compose build --no-cache app   # NEXT_PUBLIC_* is baked in at build
#   3. docker compose up -d --build          # migrations run on app container start
#
# Updating: git pull && docker compose up -d --build
#   (git pull alone does not rebuild; up -d without --build keeps the old image)
#
# Migrations are idempotent — only pending SQL files are applied on each start.

# Runtime
NODE_ENV=production
WEB_PORT=3000

# Auth
# Generate with: openssl rand -base64 32
AUTH_SECRET=change-me-generate-a-real-secret
# Must match the URL users open in the browser (include https:// and port if non-standard).
BETTER_AUTH_URL=http://localhost:3000

# Public app URL — baked into the client bundle at Docker build time.
# Set this to the same value as BETTER_AUTH_URL before `docker compose build`.
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Postgres used by docker-compose.yml
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=postgres
DATABASE_URL=postgres://postgres:postgres@localhost:5432/postgres
DB_DISABLE_SSL=true

# White-label defaults used at image build time.
# Admin-managed platform branding in the app can override these after setup.
NEXT_PUBLIC_BRAND_NAME="beenvoice"
NEXT_PUBLIC_BRAND_TAGLINE="Simple and efficient invoicing for freelancers and small businesses"
NEXT_PUBLIC_BRAND_LOGO_TEXT="beenvoice"
NEXT_PUBLIC_BRAND_ICON="$"
NEXT_PUBLIC_DEFAULT_INTERFACE_THEME="beenvoice"
NEXT_PUBLIC_DEFAULT_FONT="brand"
NEXT_PUBLIC_DEFAULT_BODY_FONT="brand"
NEXT_PUBLIC_DEFAULT_HEADING_FONT="brand"
NEXT_PUBLIC_DEFAULT_RADIUS="xl"
NEXT_PUBLIC_DEFAULT_SIDEBAR_STYLE="floating"

# Email delivery via Resend (optional)
# Leave blank to disable invoice/password-reset email delivery.
RESEND_API_KEY=
RESEND_DOMAIN=

# Analytics via Umami (optional)
# Leave website ID blank to disable analytics.
NEXT_PUBLIC_UMAMI_WEBSITE_ID=
NEXT_PUBLIC_UMAMI_SCRIPT_URL=https://analytics.umami.is/script.js

# Block new email/password registrations (optional)
# DISABLE_SIGNUPS=true

# SSO via Authentik OIDC (optional)
NEXT_PUBLIC_AUTHENTIK_ENABLED=false
AUTHENTIK_ISSUER=
AUTHENTIK_CLIENT_ID=
AUTHENTIK_CLIENT_SECRET=
AUTHENTIK_ORIGIN=