# App database configuration
DB_HOST=postgresql
DB_NAME=messages
DB_USER=user
DB_PASSWORD=pass
DB_PORT=5432

# Django
DJANGO_ALLOWED_HOSTS=*
DJANGO_SECRET_KEY=ThisIsAnExampleKeyForDevPurposeOnly
DJANGO_SETTINGS_MODULE=messages.settings
DJANGO_SUPERUSER_PASSWORD=admin

# Logging
# Set to DEBUG level for dev only
LOGGING_LEVEL_HANDLERS_CONSOLE=INFO
LOGGING_LEVEL_LOGGERS_ROOT=INFO
LOGGING_LEVEL_LOGGERS_APP=INFO

# Prometheus
ENABLE_PROMETHEUS=0
PROMETHEUS_API_KEY=ExamplePrometheusApiKey

# Python
PYTHONPATH=/app

# Messages settings

# Mail
DJANGO_EMAIL_BRAND_NAME="La Suite territoriale"
DJANGO_EMAIL_HOST="mailcatcher"
DJANGO_EMAIL_LOGO_IMG="http://localhost:8900/assets/logo-suite-numerique.png"
DJANGO_EMAIL_PORT=1025

# Media
STORAGES_STATICFILES_BACKEND=django.contrib.staticfiles.storage.StaticFilesStorage
AWS_S3_ENDPOINT_URL=http://objectstorage:9000
AWS_S3_ACCESS_KEY_ID=messages
AWS_S3_SECRET_ACCESS_KEY=password
AWS_S3_SIGNATURE_VERSION=s3v4
AWS_S3_DOMAIN_REPLACE=http://localhost:8906

# Message imports storage
STORAGE_MESSAGE_IMPORTS_ENDPOINT_URL=http://objectstorage:9000
STORAGE_MESSAGE_IMPORTS_BUCKET_NAME=msg-imports
STORAGE_MESSAGE_IMPORTS_ACCESS_KEY=st-messages
STORAGE_MESSAGE_IMPORTS_SECRET_KEY=password
STORAGE_MESSAGE_IMPORTS_EXPIRE_POLICY=600

# Object storage for tiered blob storage — points at the local
# objectstorage container; offload itself stays off by default
# (MESSAGES_BLOBS_OFFLOAD_ENABLED defaults to False in settings.py).
STORAGE_MESSAGE_BLOBS_ENDPOINT_URL=http://objectstorage:9000
STORAGE_MESSAGE_BLOBS_BUCKET_NAME=msg-blobs
STORAGE_MESSAGE_BLOBS_ACCESS_KEY=st-messages
STORAGE_MESSAGE_BLOBS_SECRET_KEY=password

# OIDC
OIDC_OP_JWKS_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/certs
OIDC_OP_AUTHORIZATION_ENDPOINT=http://localhost:8902/realms/messages/protocol/openid-connect/auth
OIDC_OP_TOKEN_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/token
OIDC_OP_USER_ENDPOINT=http://keycloak:8802/realms/messages/protocol/openid-connect/userinfo
OIDC_OP_LOGOUT_ENDPOINT=http://localhost:8902/realms/messages/protocol/openid-connect/logout

OIDC_RP_CLIENT_ID=messages
OIDC_RP_CLIENT_SECRET=ThisIsAnExampleKeyForDevPurposeOnly
OIDC_RP_SIGN_ALGO=RS256
OIDC_RP_SCOPES="openid email"

LOGIN_REDIRECT_URL=http://localhost:8900
LOGIN_REDIRECT_URL_FAILURE=http://localhost:8900
LOGOUT_REDIRECT_URL=http://localhost:8900

OIDC_REDIRECT_ALLOWED_HOSTS=localhost:8902,localhost:8900
OIDC_AUTH_REQUEST_EXTRA_PARAMS={"acr_values": "eidas1"}

# Mobile apps (Capacitor) session handoff
MOBILE_AUTH_CALLBACK_SCHEMES=["stmessages"]

# Mobile apps (Capacitor) OTA — OPT-IN in dev: channel manifest URL served to
# the apps through /config (see ota.ts). Uncomment (working dev-stack value,
# device-reachable via adb reverse) together with the publishing block in
# frontend.defaults to exercise the OTA chain.
# MOBILE_OTA_MANIFEST_URL=http://localhost:8906/messages-ota/channels/dev/manifest.json

# Push notifications — OPT-IN in dev: dark by default, per-developer
# credentials go in backend.local (see docs/mobile.md, "Push notifications in
# dev", and docs/env.md for the full reference). Each gateway no-ops until its
# variables are all set.
# - Web Push: `python manage.py generate_vapid_private_key` prints the three
#   PUSH_VAPID_* values to set.
# - iOS: PUSH_APNS_KEY/_KEY_ID/_TEAM_ID/_BUNDLE_ID + PUSH_APNS_USE_SANDBOX=True
#   (dev-signed builds hold sandbox tokens).
# - Android: PUSH_FCM_CREDENTIALS/_PROJECT_ID from your dev Firebase project.
# PUSH_ENABLED=True

# keycloak
IDENTITY_PROVIDER=keycloak
KEYCLOAK_REALM=messages
KEYCLOAK_URL=http://keycloak:8802
KEYCLOAK_CLIENT_ID=rest-api
KEYCLOAK_CLIENT_SECRET=ServiceAccountClientSecretForDev
KEYCLOAK_GROUP_PATH_PREFIX=/maildomain-

# Frontend
# FRONTEND_THEME_CONFIG={"theme": "white-label"}
# FRONTEND_FORCED_DEFAULT_LANGUAGE=false
# FRONTEND_MULTIPART_UPLOAD_CHUNK_SIZE_MB=100
# FRONTEND_HELP_CENTER_URL=https://help.example.com
# FRONTEND_FEEDBACK_WIDGET_CONFIG={"api_url": "", "path": "", "channel": "", "home_channel": ""}
# FRONTEND_LAGAUFRE_WIDGET_CONFIG={"api_url": "", "path": ""}

# Messages
MTA_OUT_MODE=relay
MTA_OUT_RELAY_HOST=mailcatcher:1025
MDA_API_SECRET=my-shared-secret-mda
SALT_KEY=ThisIsAnExampleSaltForDevPurposeOnly

# Rspamd spam-check — disabled by default. The `mpa` service is not started by
# `make start`, and a configured-but-unreachable rspamd holds inbound mail for
# retry (fail-closed), which would stall the local pipeline. To enable spam
# checks locally, start `mpa` and uncomment the line below.
SPAM_CONFIG={}
# SPAM_CONFIG={"rspamd_url": "http://mpa:8010/_api", "rspamd_auth": ""}

# AI
AI_BASE_URL=
AI_API_KEY=
AI_MODEL=

# AI features
FEATURE_AI_SUMMARY=False
FEATURE_AI_AUTOLABELS=False

# Integrations enabled in the integrations modal (mailbox admins)
FEATURE_MAILBOX_ADMIN_CHANNELS=api_key,widget,webhook

# Thread list preview line. On in dev so the feature is exercised locally;
# ships off by default because it needs backfill_thread_snippets to have run.
FEATURE_THREAD_SNIPPET=True

# Third-party services
# Drive - https://github.com/suitenumerique/drive
DRIVE_BASE_URL=