# Django Settings
DEBUG=False
SECRET_KEY=change-me-django-secret-key
ALLOWED_HOSTS=localhost,127.0.0.1,web,nginx
WEBSOCKET_ALLOW_QUERY_JWT=false
# Set explicit frontend origins when WebSocket and frontend use different hosts.
# WEBSOCKET_ALLOWED_ORIGINS=https://app.example.com

# Database Settings
USE_SQLITE=False
POSTGRES_DB=eusrr
POSTGRES_USER=eusrr_user
POSTGRES_PASSWORD=change-me-postgres-password
DB_HOST=db
DB_PORT=5432

# Redis Settings
REDIS_HOST=redis
REDIS_PORT=6379
CHANNEL_LAYER_CAPACITY=1000
CHANNEL_LAYER_EXPIRY=60
CHANNEL_LAYER_GROUP_EXPIRY=86400

# Celery Settings
CELERY_BROKER_URL=redis://redis:6379/0
CELERY_RESULT_BACKEND=redis://redis:6379/1

# Logging
LOG_FORMAT=json
LOG_LEVEL=INFO
# Routine Daphne/Channels access and protocol logs duplicate eusrr lifecycle events.
DAPHNE_LOG_LEVEL=WARNING
CHANNELS_SERVER_LOG_LEVEL=WARNING
# Enable only when every request reaches Django through a trusted proxy that
# replaces X-Forwarded-For / X-Real-IP (never directly from the internet).
LOG_TRUST_X_FORWARDED_FOR=false

# Ports (for development)
WEB_PORT=8000
FRONTEND_PORT=3000
NGINX_PORT=80

# Frontend Settings
NODE_ENV=production

# LDAP / Active Directory (disabled by default)
LDAP_ENABLED=False
LDAP_WRITE_ENABLED=False
# LDAP_URI=ldaps://ad.example.com:636
# LDAP_BIND_DN=CN=eusrr-service,OU=Service Accounts,DC=example,DC=com
# LDAP_BIND_PASSWORD=change-me-ldap-password
# LDAP_CA_CERTS=/etc/ssl/certs/company-ca.pem
# LDAP_USER_BASE=OU=Users,DC=example,DC=com
# LDAP_USERS_BASE=OU=Users,DC=example,DC=com
# LDAP_BASE_DN=OU=Users,DC=example,DC=com
# LDAP_DEPARTMENTS_BASE=OU=Departments,DC=example,DC=com
# LDAP_GROUPS_BASE=OU=Groups,DC=example,DC=com
# LDAP_POSITIONS_BASE=OU=Positions,DC=example,DC=com
# LDAP_DISMISSED_BASE=OU=Dismissed,DC=example,DC=com
# LDAP_UPN_SUFFIX=example.com
# LDAP_EMPLOYEE_ID_ATTR=employeeNumber
# LDAP_LOGIN_UID_ATTRS=uid,sAMAccountName
# LDAP_LOGIN_MAIL_ATTRS=mail,userPrincipalName

# Email Settings (if used)
# EMAIL_HOST=smtp.gmail.com
# EMAIL_PORT=587
# EMAIL_USE_TLS=True
# EMAIL_HOST_USER=your-email@example.com
# EMAIL_HOST_PASSWORD=your-email-password

# Other Settings
SITE_URL=http://localhost:8000
PORTAL_FRONTEND_URL=http://localhost:3000

# Corporate OAuth2 / OpenID Connect provider
# Generate a dedicated RSA key and mount it outside the repository.
OIDC_PROVIDER_ENABLED=false
OIDC_RSA_PRIVATE_KEY_PATH=/run/secrets/eusrr_oidc_private_key.pem
# Comma-separated old signing keys during a planned rotation.
# OIDC_RSA_PRIVATE_KEY_PATHS_INACTIVE=/run/secrets/eusrr_oidc_private_key_old.pem
OIDC_ISSUER_URL=http://localhost:8000/o
OIDC_PORTAL_LOGIN_URL=http://localhost:3000/login
OIDC_BROWSER_SESSION_SECONDS=28800
OIDC_ACCESS_TOKEN_SECONDS=3600
OIDC_ID_TOKEN_SECONDS=600
OIDC_REFRESH_TOKEN_SECONDS=43200
# Only explicitly approved legacy confidential HTTPS clients may omit PKCE.
# OIDC_LEGACY_NO_PKCE_CLIENT_IDS=gitea

# Behind an ingress that overwrites forwarded headers; never expose its app port.
# TRUST_PROXY_SSL_HEADER=true
# SECURE_SSL_REDIRECT=true
# CSRF_COOKIE_SECURE=true
# SECURE_HSTS_SECONDS=3600
# LOG_TRUST_X_FORWARDED_FOR=true
# LOG_TRUSTED_PROXY_CIDRS=127.0.0.1/32,::1/128
# Enable only after installing the matching internal nginx media locations.
# DOCUMENTS_USE_X_ACCEL_REDIRECT=true
# CHAT_ATTACHMENTS_USE_X_ACCEL_REDIRECT=true

# Web Push (generate a dedicated VAPID key pair for each environment)
# VAPID_PUBLIC_KEY=change-me-vapid-public-key
# VAPID_PRIVATE_KEY=change-me-vapid-private-key
# VAPID_ADMIN_EMAIL=admin@example.com

# LogStorm attendance analyzer
LOGSTORM_API_URL=http://localhost:8000
LOGSTORM_API_TOKEN=change-me-logstorm-token
LOGSTORM_TIMEOUT_SECONDS=30

# Finance / Payroll
# Change RULESET_VERSION whenever calculation semantics change.
PAYROLL_RULESET_ID=eusrr-standard
PAYROLL_RULESET_VERSION=2026.07.1
PAYROLL_EFFECTIVE_FROM=2026-01-01
# PAYROLL_EFFECTIVE_TO=2026-12-31
# Keep disabled until the point formula is reconciled against real Excel rows.
PAYROLL_POINT_POLICY=disabled
PAYROLL_MONEY_QUANTUM=0.01
PAYROLL_ROUNDING=half_up
PAYROLL_ALLOW_NEGATIVE_PAYABLE=false
PAYROLL_BASE_RATE_CODE=BASE
# Temporary: staff/superuser receive full payroll access during the pilot.
PAYROLL_SIMPLE_ADMIN_ACCESS=true
# Optional Fernet key for encrypted commerce integration credentials.
# Generate: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
COMMERCE_CREDENTIAL_KEY=
# A queued import should normally be picked up within seconds. Celery Beat marks
# lost queue messages as failed after this timeout; running imports use heartbeat.
COMMERCE_QUEUED_STALE_SECONDS=120
COMMERCE_RUNNING_STALE_SECONDS=600
# Long-running imports use task-specific limits instead of the global Celery
# 25/30 minute limits. The soft limit must remain below the hard limit.
COMMERCE_TASK_SOFT_TIME_LIMIT=5400
COMMERCE_TASK_TIME_LIMIT=7200