.env.example

# ============================================
# OPENNVR - ENVIRONMENT CONFIGURATION
# ============================================
# 
# ⚠️ CRITICAL SECURITY WARNING ⚠️
# 
# docker-compose.yml contains INSECURE DUMMY VALUES to allow quick testing.
# This works WITHOUT creating a .env file, but is NOT PRODUCTION-SAFE!
# 
# FOR PRODUCTION DEPLOYMENT:
# 1. Copy this file: cp .env.example .env
# 2. Generate STRONG RANDOM VALUES for all secrets below
# 3. Never commit .env to Git (already in .gitignore)
# 
# Generate strong secrets:
#   Linux/Mac:   openssl rand -hex 32
#   Windows:     -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 32 | % {[char]$_})
#
# See USER_MANUAL.md for complete security setup guide.
# ============================================

# ============================================
# DATABASE CONFIGURATION
# ============================================
# Must match docker-compose.yml credentials
POSTGRES_USER=opennvr_user
POSTGRES_PASSWORD=CHANGE_THIS_PASSWORD_123
POSTGRES_DB=opennvr_db

# Full database connection URL
# Format: postgresql://user:password@host:port/database
# For Docker: use service name 'db' as host
# For local dev: use 'localhost' as host
DATABASE_URL=postgresql://opennvr_user:CHANGE_THIS_PASSWORD_123@db:5432/opennvr_db

# ============================================
# SECURITY & AUTHENTICATION
# ============================================

# ⚠️ CHANGE THIS: JWT Secret Key for token signing (min 32 characters)
# Generate with: openssl rand -hex 32
SECRET_KEY=INSECURE_CHANGE_ME_SECRET_KEY_DUMMY_12345

# JWT Algorithm (leave as HS256)
ALGORITHM=HS256

# Access token expiration in minutes
ACCESS_TOKEN_EXPIRE_MINUTES=120

# ⚠️ CHANGE THIS: Encrypts camera credentials in database (min 32 characters)
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# WARNING: Changing this after setup requires re-entering ALL camera passwords!
CREDENTIAL_ENCRYPTION_KEY=INSECURE_CHANGE_ME_CREDENTIAL_KEY_67890

# ⚠️ CHANGE THIS: Internal API Key for service-to-service authentication
# Generate with: openssl rand -base64 32
INTERNAL_API_KEY=INSECURE_CHANGE_ME_API_KEY_ABCDEF

# ⚠️ CHANGE THIS: MediaMTX Webhook Secret
# Generate with: openssl rand -hex 32
# This secret is used to authenticate webhooks from MediaMTX to the backend
# CRITICAL: Must be strong and unique for security!
MEDIAMTX_SECRET=INSECURE_CHANGE_ME_MEDIAMTX_SECRET

# ============================================
# APPLICATION SETTINGS
# ============================================
# Debug mode (MUST be False in production!)
DEBUG=False

# Application host binding
# 0.0.0.0 = all interfaces (for Docker)
# 127.0.0.1 = localhost only (for local dev)
HOST=0.0.0.0

# Application port (inside container)
PORT=8000

# Full application URL for external access
APPLICATION_URL=http://localhost:8000

# API prefix for all endpoints
API_PREFIX=/api/v1

# ============================================
# MEDIAMTX STREAMING SERVER
# ============================================
# MediaMTX Base URL (WebRTC signaling)
MEDIAMTX_BASE_URL=http://localhost:8889

# MediaMTX Admin API v3
MEDIAMTX_ADMIN_API=http://localhost:9997/v3
MEDIAMTX_API_URL=http://localhost:9997

# MediaMTX HLS streaming
MEDIAMTX_HLS_URL=http://localhost:8888

# MediaMTX RTSP streaming
MEDIAMTX_RTSP_URL=rtsp://localhost:8554

# MediaMTX Playback URL
MEDIAMTX_PLAYBACK_URL=http://localhost:9996

# MediaMTX Configuration
MEDIAMTX_STREAM_PREFIX=cam-
MEDIAMTX_PATH_MODE=id
MEDIAMTX_AUTO_PROVISION=True

# ============================================
# DOCKER-SPECIFIC SETTINGS
# ============================================
# Recording storage path on host machine (Docker volume mount)
# Windows: D:/Recordings
# Linux: /var/lib/opennvr/recordings  
RECORDINGS_PATH=D:/Recordings

# Backend hostname for Docker service networking
# Docker: opennvr_core (service name in docker-compose.yml)
# Local dev: 127.0.0.1
BACKEND_HOST=opennvr_core

# Backend port
BACKEND_PORT=8000

# ============================================
# AI INFERENCE CONFIGURATION
# ============================================
# KAI-C Orchestrator URL
# For Docker: use service name 'ai-adapters'
# For local dev: use 'localhost'
KAI_C_URL=http://ai-adapters:9100

# KAI-C IP for whitelisting (usually localhost)
KAI_C_IP=127.0.0.1

# ============================================
# RECORDING SETTINGS
# ============================================
# Base path for camera recordings
# Docker: use container path /app/Recordings
# Local dev: use absolute path like /var/lib/opennvr/recordings
RECORDINGS_BASE_PATH=/app/Recordings

# Docker volume mount path mapping (set automatically by docker-compose.yml)
# RECORDINGS_HOST_BASE is set to ${RECORDINGS_PATH} in docker-compose.yml
# RECORDINGS_CONTAINER_BASE is set to /app/recordings in docker-compose.yml
# These are used for path mapping between host and container filesystems

# ============================================
# DEFAULT ADMIN USER
# ============================================
# Created automatically on first startup if not exists
# CHANGE PASSWORD IMMEDIATELY AFTER FIRST LOGIN!
DEFAULT_ADMIN_USERNAME=admin
DEFAULT_ADMIN_PASSWORD=admin123
DEFAULT_ADMIN_EMAIL=admin@example.com
DEFAULT_ADMIN_FIRST_NAME=System
DEFAULT_ADMIN_LAST_NAME=Administrator

# ============================================
# LOGGING CONFIGURATION
# ============================================
# Log level: DEBUG, INFO, WARNING, ERROR, CRITICAL
LOG_LEVEL=INFO

# Enable/disable file logging
LOG_FILE_ENABLED=True

# Log file path (relative to project root)
LOG_FILE_PATH=logs/server.log

# Maximum log file size in MB before rotation
LOG_FILE_MAX_SIZE_MB=50

# Number of backup log files to keep
LOG_FILE_BACKUP_COUNT=10

# Enable/disable console logging
LOG_CONSOLE_ENABLED=True

# Use JSON format for logs (useful for log aggregation)
LOG_JSON_FORMAT=False

# ============================================
# FRONTEND CONFIGURATION (app/.env)
# ============================================
# Note: Frontend env vars go in app/.env file
# VITE_API_BASE_URL=http://localhost:8000