# Published image references (pin to explicit versions, avoid latest in production)
CIO_API_IMAGE=classroomio/api:v0.1.0
CIO_DASHBOARD_IMAGE=classroomio/dashboard:v0.1.0

# Core services
POSTGRES_DB=classroomio
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres

# API runtime
PUBLIC_SERVER_URL=https://api.domain.com
TRUSTED_ORIGINS=https://app.domain.com
# Optional: cookie domain for Better Auth cross-subdomain cookies.
# Use either .domain.com (shared across subdomains) or your API host.
AUTH_COOKIE_DOMAIN=
BETTER_AUTH_SECRET=replace-with-a-long-random-secret
AUTH_BEARER_TOKEN=replace-with-a-long-random-token

# Dashboard runtime
DASHBOARD_ORIGIN=https://app.domain.com
# Browser requests use this URL. Use your public API domain, not localhost.
PUBLIC_SERVER_URL=https://api.domain.com
# Optional internal override for SSR calls in Docker network
PRIVATE_SERVER_URL=http://api:3081
# Used by API key middleware for dashboard server-side API calls.
PRIVATE_SERVER_KEY=replace-with-a-long-random-token
PUBLIC_IS_SELFHOSTED=true
PRIVATE_APP_HOST=domain.com
PRIVATE_APP_SUBDOMAINS=app,launchweek

# License (optional - for enterprise features: SSO, token-auth, no-tracking)
# Leave unset if you do not use Enterprise-only features.
# LICENSE_KEY=your-license-key

# CSP: External domains (required when self-hosted—no defaults)
# Comma-separated list for Content-Security-Policy
ALLOWED_EXTERNAL_DOMAINS=https://*.classroomio.com,https://api.classroomio.com,https://pgrest.classroomio.com,wss://*.classroomio.com,https://assets.cdn.clsrio.com,https://cdn.plyr.io

# Email (configure either Zoho token flow in app code or SMTP values)
ZOHO_TOKEN=
SMTP_HOST=
SMTP_PORT=
SMTP_USER=
SMTP_PASSWORD=
SMTP_SENDER=

# Object storage - MinIO (S3-compatible, default for Docker self-hosting)
# When API runs in Docker: use minio service name. For local API: use http://localhost:9000
MINIO_ROOT_USER=minioadmin
MINIO_ROOT_PASSWORD=minioadmin
OBJECT_STORAGE_ENDPOINT=http://minio:9000
OBJECT_STORAGE_PUBLIC_ENDPOINT=http://localhost:9000
OBJECT_STORAGE_ACCESS_KEY_ID=minioadmin
OBJECT_STORAGE_SECRET_ACCESS_KEY=minioadmin
OBJECT_STORAGE_FORCE_PATH_STYLE=true
OBJECT_STORAGE_MEDIA_PUBLIC_BASE_URL=http://localhost:9000/media