# Base application configuration
NODE_ENV=production

# Public URLs
SERVER_IP=192.168.x.x
APP_PUBLIC_URL=https://your-domain.example.com
NEXTAUTH_URL=https://your-domain.example.com
NEXTAUTH_SECRET=replace-with-strong-secret
LICENSE_SERVER_URL=https://your-license-server.example.com
LICENSE_PROJECT_CODE=flnxi-sucai
# Shared HMAC secret between material app and license server (minimum 32 characters)
LICENSE_REQUEST_SIGNING_SECRET=replace-with-shared-license-request-secret

# Paid module service URL. Keep the default only when the paid-core container runs on the same Docker network.
PAID_CORE_MODULE_URL=http://flnxi-module-paid-core:8787
# Agent -> app callback token for POST /api/license/premium-modules/runtime-status.
MODULE_RUNTIME_STATUS_TOKEN=replace-with-strong-module-runtime-status-token

# Versioned deployment images
# Customer delivery must pin the full application image tag. Do not rely on latest.
APP_IMAGE=registry.example.com/flnxi/material/flnxi-material:1.0.0
# Optional: pin runtime images to your private Registry for offline or controlled delivery.
POSTGRES_IMAGE=postgres:15-alpine
MINIO_IMAGE=minio/minio:RELEASE.2025-04-22T22-12-26Z
MINIO_MC_IMAGE=minio/mc:RELEASE.2025-04-16T18-13-26Z

# Shared-machine isolation (recommended on test servers with multiple projects)
COMPOSE_PROJECT_NAME=flnxi_sucai
APP_CONTAINER_NAME=flnxi-material
POSTGRES_CONTAINER_NAME=flnxi-postgres
MINIO_CONTAINER_NAME=flnxi-minio
MINIO_INIT_CONTAINER_NAME=flnxi-minio-init
POSTGRES_VOLUME_NAME=flnxi-postgres-data
MINIO_VOLUME_NAME=flnxi-minio-data
APP_NETWORK_NAME=flnxi-app-network
APP_PORT=4320
MINIO_API_BIND_HOST=0.0.0.0
MINIO_API_PORT=9000
MINIO_CONSOLE_BIND_HOST=127.0.0.1
MINIO_CONSOLE_PORT=9001

# Upload limits, in bytes. Defaults: single file 10GB, total request 10GB, text fields 2MB.
MAX_UPLOAD_FILE_SIZE_BYTES=10737418240
MAX_UPLOAD_TOTAL_FILE_SIZE_BYTES=10737418240
MAX_UPLOAD_FIELD_SIZE_BYTES=2097152

# Login protection
# Defaults: same IP 5 password-login attempts per minute; same account locks for 15 minutes after 5 failures.
AUTH_LOGIN_IP_WINDOW_MS=60000
AUTH_LOGIN_IP_MAX_ATTEMPTS=5
AUTH_LOGIN_ACCOUNT_MAX_FAILURES=5
AUTH_LOGIN_ACCOUNT_LOCK_MS=900000

# Database settings
# Leave DATABASE_URL empty when using the PostgreSQL service from docker-compose.prod.yml.
# Fill it only when using an external PostgreSQL database, for example:
# DATABASE_URL=postgresql://flnxi:<strong-password>@192.168.1.10:5432/flnxi?sslmode=disable
DATABASE_URL=
POSTGRES_USER=postgres
POSTGRES_PASSWORD=replace-with-strong-postgres-password
POSTGRES_DB=flnxi

# Object storage (S3 compatible)
STORAGE_PROVIDER=s3
# Default values below match the built-in MinIO service in docker-compose.prod.yml.
# For external S3/MinIO, replace S3_ENDPOINT, S3_PUBLIC_DOMAIN, access key, and secret key.
S3_ENDPOINT=http://minio:9000
S3_BUCKET=flnxi-materials
S3_ACCESS_KEY_ID=
S3_SECRET_ACCESS_KEY=
S3_REGION=us-east-1
S3_PUBLIC_DOMAIN=http://192.168.x.x:9000/flnxi-materials
S3_SET_ACL=0
S3_FILE_PATH=materials/
S3_ENV_PREFIX=
MINIO_ROOT_USER=replace-with-minio-admin-user
MINIO_ROOT_PASSWORD=replace-with-strong-minio-admin-password

# Vector database (optional)
VECTOR_DB=pgvector
PGVECTOR_DB_URL=

# DingTalk login (optional)
DINGTALK_CLIENT_ID=
DINGTALK_CLIENT_SECRET=
NEXT_PUBLIC_DINGTALK_CALLBACK_URL=

# Frontend display
NEXT_PUBLIC_DEFAULT_HEADER_LOGO_URL=
NEXT_PUBLIC_DEFAULT_LOGIN_LOGO_URL=
NEXT_PUBLIC_INTRANET_URL=
NEXT_PUBLIC_PORTAL_BASE_URL=
NEXT_PUBLIC_PUBLIC_DOMAINS=portal.example.com
PUBLIC_DOMAINS=portal.example.com

# CORS and image whitelist
ALLOWED_ORIGINS=https://portal.example.com
IMAGE_REMOTE_HOSTS=s3.example.com

# License system security (REQUIRED for license validation)
# RSA public key for license signature verification (PEM format, replace \n with \\n)
LICENSE_PUBLIC_KEY=
# Local encryption key for secure storage (minimum 32 characters)
LOCAL_ENCRYPTION_KEY=
# Optional: one-time token for manual POST /api/system/init before any admin exists
SYSTEM_INIT_TOKEN=
# Optional: explicit initial admin identity; password omitted means generate a one-time password during initialization
INIT_ADMIN_EMAIL=admin@local.flnxi
INIT_ADMIN_PASSWORD=

# Legacy one-off data restore endpoint. Keep disabled in customer environments unless doing a controlled restore window.
RESTORE_DATA_ENABLED=0
RESTORE_DATA_TOKEN=
RESTORE_DATA_ALLOWED_IPS=127.0.0.1
# Only set to 1 when the app is behind a trusted reverse proxy that strips untrusted forwarding headers.
RESTORE_DATA_TRUST_PROXY=0
RESTORE_ADMIN_EMAIL=admin@local.flnxi
RESTORE_ADMIN_USERNAME=admin
RESTORE_ADMIN_PASSWORD=
RESTORE_S3_BUCKET_URL=
RESTORE_S3_PUBLIC_URL=

# AI model (optional)
GEMINI_API_KEY=
GEMINI_API_BASE_URL=https://api.huandutech.com/v1
GEMINI_MODEL=gemini-2.0-flash-exp

# Append other custom variables below