# ============================================
# STK CONFIGURATION
# ============================================
# Lite mode: uv sync && uv run stk run (just works)
# Full mode: uv sync --extra full (Redis + asyncpg)
# ============================================

# === CORE (Required) ===
SECRET_KEY=
QUART_DEBUG=1
STK_ENV=development
SECURITY_REGISTERABLE=False
SECURITY_PASSWORD_SALT=

# === BRANDING ===
#APP_NAME=stk
#APP_TAGLINE=Secure. Scalable. Swift.
#APP_DESCRIPTION=

# === DATABASE ===
# SQLite used by default (instance/stk.db) - no config needed
# Schema changes are tracked with Alembic migrations
# PostgreSQL (uncomment for production)
#SQLALCHEMY_DATABASE_URI=postgresql+asyncpg://postgres:pass@localhost/dbname

# === FULL MODE - Redis + asyncpg (optional) ===
# Uncomment after: uv sync --extra full
#REDIS_URL=redis://localhost:6379/1

# === OAUTH (optional) ===
GOOGLE_AUTH_ENABLED=False
GOOGLE_OAUTH_CLIENT_ID=your_google_client_id
GOOGLE_OAUTH_CLIENT_SECRET=your_google_client_secret

GITHUB_AUTH_ENABLED=False
GITHUB_OAUTH_CLIENT_ID=your_github_client_id
GITHUB_OAUTH_CLIENT_SECRET=your_github_client_secret

# For local development only (remove in production)
OAUTHLIB_INSECURE_TRANSPORT=1

# === MAIL (optional) ===
MAIL_SERVER=smtp.sendgrid.net
MAIL_USERNAME=sendgrid
MAIL_PASSWORD=sendgrid_secure_password
SECURITY_EMAIL_SENDER=info@domain.com

# === SESSION & COOKIES ===
# Local HTTP only. Use True with HTTPS in production.
SESSION_COOKIE_SECURE=False
SESSION_COOKIE_HTTPONLY=True
SESSION_COOKIE_SAMESITE=Lax
# Set to True to logout other sessions on login (single session per user)
DISABLE_MULTIPLE_SESSIONS=False

# ============================================
# DOCKER CONFIGURATION (docker compose up)
# ============================================
#COMPOSE_PROJECT_NAME=__app__
#PYTHONUNBUFFERED=true
#DOCKER_UID=1000
#DB_ADMIN_PASSWORD=generate-a-separate-admin-secret
#DB_PASSWORD=generate-a-unique-secret
#REDIS_PASSWORD=generate-a-unique-secret
#SQLALCHEMY_DATABASE_URI=postgresql+asyncpg://stk:${DB_PASSWORD}@postgres/stk
#REDIS_URL=redis://:${REDIS_PASSWORD}@redis:6379/1

# Required by the production Docker stack. Use readable certificate files.
#STK_HOST=app.example.com
#TLS_CERTIFICATE=/absolute/path/fullchain.pem
#TLS_PRIVATE_KEY=/absolute/path/key.pem
#STK_PUBLIC_URL=https://app.example.com
#SECURITY_WAN_RP_ID=app.example.com
#SECURITY_WAN_EXPECTED_ORIGIN=https://app.example.com

# Optional independent MFA encryption keyring, newest key first.
# Generate Fernet keys and retain old keys during rotation. See SECURITY.md.
#SECURITY_TOTP_ENCRYPTION_KEYS=new-fernet-key,old-fernet-key
