# =============================================================================
# Copy to .env and adjust. Never commit the real .env.
#   cp .env.example .env
#
# Generate a strong secret:
#   python -c "import secrets; print(secrets.token_urlsafe(64))"
# =============================================================================

# --- Django ------------------------------------------------------------------
DJANGO_SETTINGS_MODULE=config.settings.prod
DJANGO_SECRET_KEY=change-me-to-a-64-character-random-string-before-any-real-deployment
DJANGO_DEBUG=false
DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,backend
DJANGO_ADMIN_URL=admin/
# Serve /api/docs/, /api/redoc/ and /api/schema/.  Handy locally; set to false
# on any public deployment, since they describe every endpoint and payload in
# the service and are reachable without authenticating.
SERVE_API_DOCS=true
ENVIRONMENT=development
SERVICE_NAME=linkedin-search-api
SECURE_SSL_REDIRECT=false

# The SPA is served from the same origin through nginx, so this list only
# matters when you run `npm run dev` against the containerised API.
CORS_ALLOWED_ORIGINS=http://localhost:8080,http://localhost:5173
CSRF_TRUSTED_ORIGINS=http://localhost:8080,http://localhost:5173

# --- PostgreSQL --------------------------------------------------------------
POSTGRES_DB=linkedin
POSTGRES_USER=linkedin
POSTGRES_PASSWORD=change-me-postgres
POSTGRES_HOST=postgres
POSTGRES_PORT=5432

# --- Redis (cache + throttling counters) -------------------------------------
REDIS_URL=redis://redis:6379/1

# --- JWT ---------------------------------------------------------------------
JWT_ACCESS_MINUTES=15
JWT_REFRESH_DAYS=7

# --- Search ------------------------------------------------------------------
# "elasticsearch" (default) or "postgres" to run without a cluster.
SEARCH_BACKEND=elasticsearch
ELASTICSEARCH_HOST=elasticsearch
ELASTICSEARCH_PORT=9200
ELASTICSEARCH_HOSTS=http://elasticsearch:9200
ELASTICSEARCH_INDEX=linkedin-profiles
ELASTICSEARCH_TIMEOUT=10
# Only needed when the cluster has authentication enabled (docker-compose.prod.yml).
ELASTIC_PASSWORD=change-me-elastic
ELASTICSEARCH_USERNAME=
ELASTICSEARCH_PASSWORD=

# --- Logging / ELK -----------------------------------------------------------
LOG_LEVEL=INFO
LOGSTASH_ENABLED=true
LOGSTASH_HOST=logstash
LOGSTASH_PORT=5959

# --- Rate limiting -----------------------------------------------------------
THROTTLE_ANON=30/min
THROTTLE_USER=300/min
THROTTLE_SEARCH=120/min
THROTTLE_LOGIN=10/min

# --- Bootstrap ---------------------------------------------------------------
# The API container imports the dataset and builds the index on first start.
SEED_DATASET=true
SEED_USERS=true
RUN_MIGRATIONS=true
DATASET_PATH=/data/linkedin_profiles.csv

# Demo accounts created by `manage.py seed_users` (used by the README walkthrough).
DEMO_ADMIN_EMAIL=admin@example.com
DEMO_ADMIN_PASSWORD=Admin-Passw0rd!
DEMO_ANALYST_EMAIL=analyst@example.com
DEMO_ANALYST_PASSWORD=Analyst-Passw0rd!
DEMO_VIEWER_EMAIL=viewer@example.com
DEMO_VIEWER_PASSWORD=Viewer-Passw0rd!

# --- Resource sizing ---------------------------------------------------------
ES_JAVA_OPTS=-Xms512m -Xmx512m
LS_JAVA_OPTS=-Xms256m -Xmx256m
GUNICORN_WORKERS=3

# --- Published ports ---------------------------------------------------------
FRONTEND_PORT=8080
BACKEND_PORT=8000
KIBANA_PORT=5601