.env.example

# Milestone - Environment Configuration
# Copy this file to .env and update values for your environment
#
# IMPORTANT: Never commit .env files with real credentials!

# ============================================
# APPLICATION
# ============================================
DEBUG=false
PORT=8485

# ============================================
# DATABASE (PostgreSQL) - TENANT DATABASE
# ============================================
# Single-tenant mode: this is your main database.
# Multi-tenant mode: DB_HOST / DB_PORT are still the server every tenant
# database is reached on (each tenant connects with its own encrypted
# credentials from the master DB), and DB_NAME / DB_USER / DB_PASSWORD are the
# "default" database used by /health and by requests without a /t/{slug}/
# prefix. Tenant metadata itself lives in the MASTER_DB_* database below.

# Option 1: Individual settings
DB_HOST=localhost
DB_PORT=5432
DB_NAME=milestone
DB_USER=milestone
DB_PASSWORD=your_secure_password_here
DB_SSL=false

# Option 2: Connection URL (overrides individual settings)
# DATABASE_URL=postgresql://milestone:password@localhost:5432/milestone

# Connection pool settings
DB_POOL_SIZE=20
DB_POOL_MAX_OVERFLOW=10
DB_POOL_TIMEOUT=30

# ============================================
# SESSION & SECURITY
# ============================================
# REQUIRED. Signs the SSO state and, in single-tenant mode, derives the key that
# encrypts stored secrets (tenant SSO client secret) — changing it later means
# re-entering the SSO client secret. The app refuses to start with DEBUG=false
# when this is empty or a published placeholder.
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
SESSION_SECRET=

# Session cookie settings
SESSION_COOKIE_NAME=connect.sid
SESSION_MAX_AGE=86400

# Set to true when serving over HTTPS (marks cookies as Secure)
SECURE_COOKIES=false

# CORS allowed origins (comma-separated)
# Required for production if frontend is on a different origin
# If not set: allows localhost in debug mode, blocks all cross-origin in production
# CORS_ORIGINS=https://app.example.com,https://admin.example.com

# Reverse proxy (nginx, Traefik, Nginx Proxy Manager, Caddy, ...) in front of
# the app? List the proxy's IP address(es), comma-separated, so uvicorn takes
# the client address from X-Forwarded-For. Without it every visitor appears as
# the proxy: the failed-login lockout (10 bad passwords per IP + e-mail in
# 15 min) then applies to that e-mail for everyone, so anyone could lock a
# known account out. Use * only when the app port is reachable solely through
# the proxy (e.g. a private Docker network, port not published publicly) —
# otherwise clients could forge X-Forwarded-For. Default: 127.0.0.1.
# FORWARDED_ALLOW_IPS=127.0.0.1

# ============================================
# MULTI-TENANT MODE
# ============================================
# Set to true for multi-tenant deployment
MULTI_TENANT=false

# Default tenant slug (optional, for development)
DEFAULT_TENANT=

# Master database (required for multi-tenant mode)
# This stores tenant configurations and admin users
MASTER_DB_HOST=localhost
MASTER_DB_PORT=5432
MASTER_DB_NAME=milestone_master
MASTER_DB_USER=postgres
MASTER_DB_PASSWORD=your_master_password

# PostgreSQL admin credentials (for auto-provisioning tenant databases)
# Needs CREATEDB and CREATEROLE privileges
PG_ADMIN_USER=postgres
PG_ADMIN_PASSWORD=your_postgres_admin_password

# Encryption key for tenant database credentials and SSO client secrets
# (32 bytes, hex encoded). REQUIRED for multi-tenant mode; optional in
# single-tenant mode (the key is then derived from SESSION_SECRET).
# Generate with: python -c "import secrets; print(secrets.token_hex(32))"
TENANT_ENCRYPTION_KEY=

# ============================================
# MICROSOFT ENTRA SSO (Optional)
# ============================================
# SSO is configured in the app, not here: tenant admins use Settings -> SSO,
# and organization-wide SSO is set in the admin portal. SSO_* environment
# variables are not read.

# ============================================
# EXTERNAL APIs
# ============================================
# Bank holiday API (Nager)
# The legacy v3 API (https://date.nager.at/api/v3) is still accepted and
# detected automatically, but reaches end of life on 2027-01-31.
NAGER_API_URL=https://nagerholidays.com/api/v4

# ============================================
# OUTBOUND PROXY (Optional, corporate networks)
# ============================================
# Used for outbound HTTP (Nager holiday API, Microsoft Graph). PAC files supported.
# HTTP_PROXY=http://proxy.example.com:8080
# HTTPS_PROXY=http://proxy.example.com:8080
# PROXY_USERNAME=
# PROXY_PASSWORD=
# PROXY_PAC_URL=
# PROXY_VERIFY_SSL=true
# PROXY_CA_CERT=

# ============================================
# AUTO-INITIALIZATION (fresh installs)
# ============================================
# When true, the container runs app.scripts.init_db on start (creates the
# schema and seeds an admin). Password is auto-generated and printed in the
# container logs if INIT_ADMIN_PASSWORD is left empty.
# AUTO_INIT_DB=false
# INIT_ADMIN_EMAIL=admin@milestone.local
# INIT_ADMIN_PASSWORD=

# ============================================
# FRESH INSTALL (docker-compose.fresh.yml)
# ============================================
# Override these to avoid conflicts with existing containers/ports
# FRESH_APP_PORT=8486
# FRESH_DB_PORT=5433

# ============================================
# TIMEZONE
# ============================================
TZ=Europe/Zurich