.env.example

# === ThinkWatch — Development Environment ===
# Copy to .env and fill in values. Use `deploy/generate-secrets.sh` to
# generate (it targets .env.production by default; for dev, copy this
# file by hand and run `openssl rand -hex 32` for each secret).
#
# Read by: cargo run / `make dev-backend` (via dotenvy) AND
#          docker compose -f deploy/docker-compose.dev.yml --env-file .env

# --- PostgreSQL ---
DB_USER=thinkwatch                # used by docker-compose.dev.yml
DB_PASSWORD=                      # openssl rand -hex 16
DB_NAME=think_watch
DB_MAX_CONNECTIONS=10             # read by crates/common/src/db.rs
DATABASE_URL=postgres://${DB_USER}:${DB_PASSWORD}@localhost:5432/${DB_NAME}

# --- Redis ---
REDIS_PASSWORD=                   # openssl rand -hex 16
REDIS_URL=redis://:${REDIS_PASSWORD}@localhost:6379

# --- Application ---
JWT_SECRET=                       # REQUIRED: openssl rand -hex 32
ENCRYPTION_KEY=                   # REQUIRED: openssl rand -hex 32 (exactly 64 hex chars)
SERVER_HOST=0.0.0.0
GATEWAY_PORT=3000
CONSOLE_PORT=3001
CORS_ORIGINS=http://localhost:5173
RUST_LOG=info,think_watch=debug

# --- ClickHouse (audit log storage & search) ---
CLICKHOUSE_URL=http://localhost:8123
CLICKHOUSE_DB=think_watch
CLICKHOUSE_USER=thinkwatch
CLICKHOUSE_PASSWORD=              # openssl rand -hex 16

# --- Zitadel (dev OIDC provider; not used in production) ---
ZITADEL_PG_PASSWORD=              # openssl rand -hex 16
ZITADEL_MASTERKEY=                # openssl rand -hex 16 (exactly 32 hex chars)

# --- Optional: /metrics scraping ---
# When this is unset, the /metrics route is NOT mounted at all (returns
# 404) — the safe default, since the endpoint leaks cost / token / error
# signals. Set to `openssl rand -hex 32` to enable Prometheus scraping;
# the scraper must then pass the same value as `Authorization: Bearer <value>`.
# METRICS_BEARER_TOKEN=