# CI stack settings. Committed on purpose: it holds no secret.
# Secrets come from ci/ci-secrets/, made fresh by ci/make-secrets.sh on every run.
# Relative paths resolve against deploy/, the compose project directory.
# CI never reaches VISUAL, M-Files, AD or the mail relay. Phase 1 adds the Samba DC and fixtures.

# ---- Compose (read by docker compose; also passed to the containers, which ignore them) ----
# Compose project name. Keeps prod and test volumes apart.
PROJECT_NAME=packetstation-ci
# This file's own path. Compose hands it to the containers as env_file.
ENV_FILE=./ci/ci.env
# Image to run. Always a tested release tag, never latest.
IMAGE=packetstation:ci
# Host folder of secret files, root:10001 mode 0440.
SECRETS_DIR=./ci/ci-secrets
# Host PEM file with the PESCO CA chain. Mounted at /etc/ssl/pesco/ca.pem.
CA_BUNDLE_FILE=./ci/ci-secrets/ca.pem
# Host backup folder, mounted read-only in the worker. Compose sets BACKUP_DIR=/backups inside.
BACKUP_DIR=./ci/ci-backups

# ---- Stack and site ----
# prod, test, ci or dev. Guards against crossing stacks.
STACK=ci
# Site key.
SITE_ID=PESCO
# Site time zone for schedules and display. Containers run in UTC.
SITE_TZ=America/Denver
# Public URL, used in links and mail.
PUBLIC_URL=http://app:8000
# Only this container may set X-Forwarded-*. The app re-resolves it. Empty trusts nobody.
TRUSTED_PROXY_HOST=
# DEBUG, INFO, WARNING or ERROR. Logs go to stdout.
LOG_LEVEL=DEBUG
# Worker heartbeat file read by its healthcheck. /tmp is a tmpfs.
WORKER_BEAT_FILE=/tmp/packetstation-worker.beat

# ---- PostgreSQL (roles made by deploy/postgres/initdb/01-roles.sh) ----
# postgres alias on the internal backend network.
PG_HOST=packetstation-postgres
# PostgreSQL port.
PG_PORT=5432
# Database name.
PG_DATABASE=packetstation
# Runtime role for the app and worker.
PG_APP_USER=ps_app
# Its password, from the compose secret.
PG_APP_PASSWORD_FILE=/run/secrets/postgres_app_password
# Schema owner. Used by migrate only.
PG_MIGRATE_USER=ps_migrate
# Its password, from the compose secret.
PG_MIGRATE_PASSWORD_FILE=/run/secrets/postgres_migrate_password

# ---- Keys and paths inside the container ----
# Session signing key.
SESSION_KEY_FILE=/run/secrets/session_key
# HMAC key for record seals.
SEAL_KEY_FILE=/run/secrets/seal_key
# Assets volume. Compose sets it too.
ASSETS_DIR=/data/assets
# Built frontend. Compose sets it too.
STATIC_DIR=/app/static

# ---- LDAP (PESCO Active Directory; CI gets the Samba DC in phase 1) ----
# Both domain controllers, tried in order.
LDAP_URL=
# Search base for users.
LDAP_BASE_DN=
# Service account for searches.
LDAP_BIND_DN=
# Service account password, from the compose secret.
LDAP_PASSWORD_FILE=/run/secrets/ldap_bind_password
# User search filter. {0} is the escaped sign-in name.
LDAP_USER_FILTER="(|(sAMAccountName={0})(userPrincipalName={0}))"
# OU that holds the 50 PS-* groups.
LDAP_GROUP_BASE_DN=
# CA chain used to verify the controllers.
LDAP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
# false with ldaps://. true only with ldap:// on 389.
LDAP_STARTTLS=false
# Never true outside local development.
LDAP_ALLOW_INSECURE=false

# ---- Mail (relay app-03, no auth) ----
# Relay host. Empty disables mail.
SMTP_HOST=
# Relay port.
SMTP_PORT=25
# Sender address.
SMTP_FROM=noreply@pescoinc.biz
# Require STARTTLS.
SMTP_STARTTLS=true
# CA chain used to verify the relay.
SMTP_CA_BUNDLE=/etc/ssl/pesco/ca.pem
# true logs notifications and sends nothing.
NOTIFY_DRY_RUN=true

# ---- VisualKit (VISUAL ERP, read only) ----
# SQL Server instance. Full name: containers have no search domain.
VISUAL_SERVER=
# VISUAL database.
VISUAL_DATABASE=
# Read-only SQL login.
VISUAL_USER=visualkit_ro
# Its password, from the compose secret.
VISUAL_PASSWORD_FILE=/run/secrets/visualkit_password
# no until vsql has a trusted certificate (open question 6).
VISUAL_ENCRYPT=no
# ODBC driver name installed in the image.
VISUAL_DRIVER="ODBC Driver 18 for SQL Server"

# ---- MFilesKit (M-Files, read only; there is no test vault, so test reads production) ----
# M-Files REST endpoint.
MFILES_URL=
# Vault GUID.
MFILES_VAULT_GUID=
# Read-only user. The entrypoint exports MFILES_PASSWORD from its secret file.
MFILES_USERNAME=
# CA chain used to verify M-Files.
MFILES_CA_BUNDLE=/etc/ssl/pesco/ca.pem