# Ekklesia API and operator commands (`api` and `migrate`). Reference deployment, ADR 0044.
#
# Install as EKKLESIA_ENV_DIR/ekklesia.env (default /etc/ekklesia/ekklesia.env), owned by root with
# mode 600:
#   install -o root -g root -m 600 env/ekklesia.env.example /etc/ekklesia/ekklesia.env
# Never commit the filled-in file. Generate secrets with scripts/gen-secrets.sh, and the database CA
# line with scripts/init-tls.sh.
#
# The image already sets NODE_ENV=production, EKKLESIA_API_HOST=0.0.0.0, EKKLESIA_API_PORT=3000, and
# EKKLESIA_MODULES_DIR=/var/lib/ekklesia/modules. Compose sets NODE_EXTRA_CA_CERTS and mounts module
# storage at that path. The proxy overlay sets the three EKKLESIA_CLIENT_ADDRESS_* variables. None of
# those belong here.
#
# Installed modules (ADR 0048) are read from EKKLESIA_MODULES_DIR, which must name the mounted
# directory. Move the host directory with EKKLESIA_MODULES_HOST_DIR in deploy/.env instead.
# EKKLESIA_MODULES_DIR=/var/lib/ekklesia/modules
#
# Values that are part of the reference topology are filled in; everything installation-specific is
# blank. Full reference: docs/development/api.md#required-configuration.

# --- Database (ADR 0018) ------------------------------------------------------------------------
# The host must be exactly `postgres`: the server certificate is issued for that name and
# verify-full checks it. User, password, and database must match postgres.env. Percent-encode any
# reserved character in the password. Never add sslmode or another TLS parameter to this URL.
DATABASE_URL=postgresql://<user>:<password>@postgres:5432/<database>
EKKLESIA_DATABASE_TLS_MODE=verify-full
# The installation-private CA as PEM text (not a path), on one double-quoted line with \n escapes.
# scripts/init-tls.sh prints this exact line. It is the only CA the database connection trusts.
EKKLESIA_DATABASE_CA=

# --- Identity (ADR 0011, ADR 0018, ADR 0034, ADR 0045) -----------------------------------------
# The public https origin of the API, with no path: the Ekklesia hostname in the same-origin
# topology, the API's hostname in the split one. Production rejects http and loopback origins.
EKKLESIA_IDENTITY_BASE_URL=
# Comma-separated exact origins allowed to make credentialed requests. The API's own origin is
# always trusted and need not be listed. Same-origin topology: the base URL. Split topology: the
# Dashboard's origin.
EKKLESIA_IDENTITY_TRUSTED_ORIGINS=
# At least 32 random characters. Rotating it signs every user out.
EKKLESIA_IDENTITY_SECRET=
# Same-origin topology: leave unset; the Dashboard is served from the base URL (ADR 0044).
# Split topology: the Dashboard's https origin, which must also be in the trusted origins. Emailed
# verification and reset links land here (ADR 0045).
# EKKLESIA_DASHBOARD_ORIGIN=
# Production refuses public sign-up. Leave unset.
# EKKLESIA_PUBLIC_SIGNUP_ENABLED=

# --- Client address (ADR 0017) ------------------------------------------------------------------
# Set by compose.proxy.yaml. Only a base-only deployment behind its own proxy sets these here, with
# that proxy's fixed address as the only trusted entry (deploy/README.md):
# EKKLESIA_CLIENT_ADDRESS_MODE=trusted-proxy
# EKKLESIA_CLIENT_ADDRESS_HEADER=x-forwarded-for
# EKKLESIA_CLIENT_ADDRESS_TRUSTED_PROXIES=<proxy address>/32

# --- Object storage (ADR 0030, ADR 0031) --------------------------------------------------------
# The API reaches SeaweedFS over HTTPS on the private network; production storage must be https.
S3_ENDPOINT=https://object-storage:8443
# The https origin browsers fetch signed object URLs from: the storage hostname on the proxy.
S3_DELIVERY_ENDPOINT=
# Must match object-storage.env.
S3_ACCESS_KEY=
S3_SECRET_KEY=
S3_REGION=us-east-1
S3_FORCE_PATH_STYLE=true
S3_BUCKET_PREFIX=ekklesia

# --- Outbound email (ADR 0037), optional --------------------------------------------------------
# Without a relay, email verification and password recovery cannot deliver. See
# docs/development/email.md.
# EKKLESIA_SMTP_HOST=
# EKKLESIA_SMTP_PORT=587
# EKKLESIA_SMTP_SECURITY=starttls
# EKKLESIA_SMTP_USERNAME=
# EKKLESIA_SMTP_PASSWORD=
# EKKLESIA_SMTP_FROM_ADDRESS=
# EKKLESIA_SMTP_FROM_NAME=Ekklesia
# EKKLESIA_SMTP_HELO_NAME=

# --- Module secrets (ADR 0029), as installed modules declare them --------------------------------
# EKKLESIA_MODULE_SECRET__<MODULE_ID>__<KEY>=