# Production env for ambrosio — copy to .env on the server and fill in secrets.
# Generate JWT triplet: bash infra/scripts/rotate-jwt.sh

# ── App + Supabase API (single domain, routed by Traefik on ambrosio) ──────
PUBLIC_APP_URL=https://erosi.limonia.net
PUBLIC_SUPABASE_URL=https://erosi.limonia.net

# ── External Keycloak ──────────────────────────────────────────────────────
# The client must be confidential, with `openid` as a default client scope
# (GoTrue v2.158.1 doesn't send `openid` in the OAuth scope param — Keycloak
# must inject it), redirectUris including https://erosi.limonia.net/* and
# https://erosi.limonia.net/auth/v1/callback, and webOrigins https://erosi.limonia.net.
#
# NOTE: if your Keycloak uses the legacy `/auth/` base path (Keycloak ≤ 16 and
# some later distributions), PUBLIC_KEYCLOAK_URL must include it — e.g.
# https://auth.example.com/auth. Verify before deploying: a GET on
# ${PUBLIC_KEYCLOAK_URL}/realms/${PUBLIC_KEYCLOAK_REALM}/.well-known/openid-configuration
# must return 200 JSON. 404 = wrong base path.
PUBLIC_KEYCLOAK_URL=https://your-keycloak.example.com
PUBLIC_KEYCLOAK_REALM=your-realm
PUBLIC_KEYCLOAK_CLIENT_ID=your-client-id
KEYCLOAK_CLIENT_SECRET=CHANGEME-paste-from-external-keycloak

# ── Reverse proxy ──────────────────────────────────────────────────────────
# TLS + outermost routing live outside this repo. The stack exposes a single
# host port (3000) where an internal Caddy fans out kong (Supabase API) vs
# app (SvelteKit). Configure whatever external proxy you use to terminate
# HTTPS for PUBLIC_APP_URL and forward plain HTTP to ambrosio:3000.

# ── Postgres (single password for all internal roles) ───────────────────────
POSTGRES_PASSWORD=CHANGEME-strong-random-password

# ── Supabase JWT triplet (regenerate every 90 days) ─────────────────────────
# Produce all three with: bash infra/scripts/rotate-jwt.sh
SUPABASE_JWT_SECRET=CHANGEME-openssl-rand-base64-48
PUBLIC_SUPABASE_ANON_KEY=CHANGEME-sign-with-above
SUPABASE_SERVICE_ROLE_KEY=CHANGEME-sign-with-above

# ── Realtime encryption ─────────────────────────────────────────────────────
# DB_ENC_KEY: exactly 16 characters. SECRET_KEY_BASE: ≥ 64 characters.
REALTIME_ENC_KEY=CHANGEME16charkey
REALTIME_SECRET_KEY_BASE=CHANGEME-openssl-rand-base64-64-at-minimum-so-phoenix-is-happy
