# Local development environment for infra/docker-compose.yml.
# Copy to infra/.env and replace every "change-me" placeholder before starting:
#   cp .env.example .env
# Every value here is a placeholder. Never commit real secrets.
# In production all secrets come from the platform secret manager (see
# docs/adr/0004-provider-neutral-encrypted-data-boundary.md).

APP_ENV=development
TZ=Europe/Moscow

# --- PostgreSQL -------------------------------------------------------------
POSTGRES_USER=finance
POSTGRES_PASSWORD=change-me-openssl-rand-hex-16
POSTGRES_DB=finance
POSTGRES_HOST_PORT=5432
APP_DATABASE_USER=finance_app
APP_DATABASE_PASSWORD=change-me-openssl-rand-hex-16

# --- Redis ------------------------------------------------------------------
REDIS_HOST_PORT=6379

# --- MinIO (S3-compatible test storage) --------------------------------------
MINIO_ROOT_USER=finance-local
MINIO_ROOT_PASSWORD=change-me-openssl-rand-hex-24
MINIO_API_HOST_PORT=9000
MINIO_CONSOLE_HOST_PORT=9001
S3_BUCKET_STATEMENTS=finance-statements
S3_REGION=us-east-1

# --- Mailpit (test SMTP sink) ------------------------------------------------
MAILPIT_SMTP_HOST_PORT=1025
MAILPIT_UI_HOST_PORT=8025

# --- Host port overrides -----------------------------------------------------
API_HOST_PORT=8000
FRONTEND_HOST_PORT=8080

# --- Application secrets (placeholders; generate per environment) -----------
# openssl rand -hex 32
SESSION_SECRET=change-me-openssl-rand-hex-32
# openssl rand -base64 32 ; production: KEK lives in the secret manager only
DATA_ENCRYPTION_KEK_ID=dev-kek-1
DATA_ENCRYPTION_KEK=change-me-base64-openssl-rand-base64-32
ADMIN_BOOTSTRAP_TOKEN=change-me-openssl-rand-hex-32
SMTP_FROM=no-reply@finance.local

# --- Frontend ----------------------------------------------------------------
# No frontend variables are required: the app calls the same-origin /api/v1.
# Anything prefixed with VITE_ is compiled into the public bundle and is NOT a
# secret. Never place credentials, keys or tokens in VITE_ variables.