# Copy this file to `.env` (same folder: apps/server/.env) and fill it in.
# The dev/start scripts load it automatically via Node's --env-file-if-exists.
#
#   cp apps/server/.env.example apps/server/.env
#
# Required ----------------------------------------------------------------
# The server refuses to start without a strong JWT_SECRET (>=32 chars).
# Generate one with:  openssl rand -hex 32
JWT_SECRET=

# Dedicated HMAC key for signing the append-only event ledger (>=16 chars).
# Generate with:  openssl rand -hex 32
# If unset, the server falls back to JWT_SECRET (logged as a warning) — fine for
# dev, but set a dedicated key before production. Events store the key that signed
# them (keyId), so verifyChain still validates a chain that spans a key change.
EVENT_SIGNING_KEY=

# Optional ----------------------------------------------------------------
# PORT=3000
# HOST=0.0.0.0                 # interface to bind. 127.0.0.1 = loopback only.
# LOG_LEVEL=info
# DATABASE_URL=./parking.sqlite
#
# Auth-cookie Secure flag. FAIL-SAFE: cookies are Secure (HTTPS-only) BY DEFAULT —
# you only ever opt OUT, never in. Set COOKIE_SECURE=0 for a plain-HTTP deployment
# (e.g. the LAN appliance serving the SPA same-origin over http, where a Secure
# cookie would never be sent and would lock operators out). Local dev over
# http://localhost MUST set this (the dev .env does). Leave unset in any TLS deploy.
# COOKIE_SECURE=0

# Recycle bin retention: a soft-deleted user/role/subscription/plan/tariff is auto-purged
# this many days after deletion (a 6-hourly sweep). Default 30. Set 0 to keep deleted
# items forever (manual purge only). See wiki/concepts/soft-delete.md.
# RECYCLE_BIN_RETENTION_DAYS=30

# First admin (seed once): pnpm --filter @parking/server seed-admin
# ADMIN_USER=admin
# ADMIN_PASS=

# Comma-separated extra origins allowed to open the booth WebSocket (/api/ws).
# In dev, set the Vite SPA origin. Same-origin is always allowed without this.
# The Tauri DESKTOP shell loads from tauri://localhost (Linux may also send
# http://tauri.localhost), which is NOT same-origin with the backend — add both
# so the desktop app's live feed connects. See apps/desktop.
# To open the dev SPA from another LAN device (phone over wifi), Vite must bind
# 0.0.0.0 (vite.config.ts) AND the host's LAN origin must be listed here, e.g.
# http://10.0.10.203:5173 — the WS handshake's Origin is that LAN address.
WS_ALLOWED_ORIGINS=http://localhost:5173,tauri://localhost,http://tauri.localhost

# Vision / ANPR (optional) -------------------------------------------------
# OFF by default. The Node SERVER's view of the vision microservice (apps/vision),
# which runs as a separate process with its OWN apps/vision/.env. Both sides share the
# VISION_ prefix but are different processes — keep the two .env files separate.
# See wiki/entities/opencv-anpr-service.md "Configuration".
# ANPR rides the entry/exit snapshot (button / QR / RFID triggers it) — no polling.
# VISION_ENABLED=1                       # master switch — nothing runs without it
# VISION_URL=http://127.0.0.1:8089       # must match apps/vision VISION_HOST:VISION_PORT
# VISION_TIMEOUT_MS=1500                 # per-request cap so a slow call can't hang the lane
# VISION_MIN_CONFIDENCE=0.5              # confidence floor; keep in sync with the service