# ==============================================================================
#  AR Aging — environment template (this file IS committed; real copies are NOT)
#
#  Local development:   cp .env.example .env             -> fill the LOCAL section
#  Production (AWS):    cp .env.example .env.production  -> fill the PRODUCTION section
#
#  .env and .env.production are gitignored — secrets never enter git.
# ==============================================================================


# ------------------------------------------------------------------ LOCAL (dev)
# Database: leave MYSQL_* unset and the app uses a local SQLite file —
#   backend/data/ar_aging.db   (zero setup; this is the local database "name")
# Force it explicitly if you like:
AR_DB_BACKEND=sqlite

# Signs login tokens (sessions survive backend restarts). Generate:
#   python -c "import secrets; print(secrets.token_hex(32))"
AR_SECRET_KEY=

# Login: auto = required as soon as users exist (create with: python manage.py add-user)
AR_AUTH=auto

# Vite dev server origins
AR_CORS_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,http://localhost:5174,http://127.0.0.1:5174

# Exchange rates: frankfurter = free, keyless, central-bank rates
AR_FX_PROVIDER=frankfurter
# Processing auto-fetches the provider's DAILY rates over each closing's transaction
# span, so dated movements convert at their own transaction date's rate. Set 0 to
# disable (the AR Ledger's "Fetch daily rates" button still works).
#AR_FX_AUTO_DAILY=1

# Email (optional) — enables "email me a code" for password resets.
# Preferred: the company's internal Mail API (bearer token; ask Talha/IT for the values).
#AR_MAIL_API_URL=
#AR_MAIL_API_TOKEN=
# Fallback: any SMTP account (used only if AR_MAIL_API_URL is unset):
#   Office365: smtp.office365.com : 587    Gmail: smtp.gmail.com : 587 (app password)
# Both unset -> passwords change via current password / admin reset instead.
#AR_SMTP_HOST=
#AR_SMTP_PORT=587
#AR_SMTP_USER=
#AR_SMTP_PASSWORD=
#AR_SMTP_FROM=

# Generated exports older than this are purged (uploads are NEVER auto-deleted). 0 = keep.
AR_RETENTION_DAYS=90


# ------------------------------------------------------------- PRODUCTION (AWS)
# Used by docker-compose.prod.yml. Fill these in .env.production on the server.

# Domain — DNS A record must point at the server; HTTPS certificate is automatic.
#AR_DOMAIN=ar.utopiabrands.com

# MySQL (the database is created automatically on first start).
# MYSQL_HOST is set to the compose service name by docker-compose.prod.yml.
#MYSQL_PORT=3306
#MYSQL_DATABASE=account_finance
#MYSQL_USER=ar_app
#MYSQL_PASSWORD=            <- strong generated password
#MYSQL_ROOT_PASSWORD=       <- different strong generated password
#MYSQL_SLOW_QUERY_MS=500
#MYSQL_POOL_SIZE=10
#MYSQL_POOL_RECYCLE=3600

# Auth — REQUIRED in production. Different key than local!
#AR_SECRET_KEY=             <- openssl rand -hex 32
#AR_AUTH=on
#AR_AUTH_TOKEN_HOURS=12

# Same-origin behind nginx/caddy; still set exactly.
#AR_CORS_ORIGINS=https://ar.utopiabrands.com

#AR_FX_PROVIDER=frankfurter
# AR_FX_PROVIDER=exchangerate-api      # paid fallback ($10/mo) — then set:
# AR_FX_API_KEY=

# Email for password codes (see the LOCAL section for the transports)
#AR_MAIL_API_URL=
#AR_MAIL_API_TOKEN=
#AR_SMTP_HOST=
#AR_SMTP_PORT=587
#AR_SMTP_USER=
#AR_SMTP_PASSWORD=
#AR_SMTP_FROM=

#AR_RETENTION_DAYS=90
# AR_MAX_UPLOAD_BYTES=2147483648       # 2 GB default

# Nightly backups (deploy/backup.sh) — S3 bucket; instance IAM role grants access.
#AR_BACKUP_S3_BUCKET=s3://utopia-ar-backups