# Server-side secrets for server-infra deploy.
# Copy to the control node (ai-server-4080 — never commit):
#   ~/Documents/secrets/chat_backend/chat_backend_prod.env
#   ~/Documents/secrets/chat_backend/chat_backend_beta.env   (optional)
#
# server-infra pushes these to /opt/apps/env/chat_backend_<env>.env on each host at deploy time.
#
# Docker Compose: if a secret contains $ (e.g. in DATABASE_URL password), escape each
# $ as $$ or compose will treat $word as a variable (see "pqv1n variable is not set").

# =============================================================================
# PROD template — ports/hosts for production
# =============================================================================
DJANGO_ENV=prod
DJANGO_DEBUG=false
# Must NOT be empty, must NOT start with django-insecure, must NOT contain "dev-only".
# If the secret contains $, escape each as $$ (Compose variable expansion).
DJANGO_SECRET_KEY=replace-with-a-long-random-secret
DJANGO_ALLOWED_HOSTS=chatbackend.aimloperations.com
# Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
# Capacitor WebView origins (https://localhost, capacitor://localhost) are always merged in code.
# DJANGO_CSRF_TRUSTED_ORIGINS=https://chatbackend.aimloperations.com,https://chat.aimloperations.com
CORS_ALLOWED_ORIGINS=https://chat.aimloperations.com
CORS_ORIGIN_ALLOW_ALL=false
USE_TLS_PROXY=true

# Shared external Postgres (10.0.0.230) — prod database
DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend

# Host port on adama/roslin/ai-server-4080 (must match server-infra host_apps)
WEB_PORT=8003

# Ollama on GPU host (ai-server-4080). Firewall must allow 10.0.0.0/24 → :11434.
OLLAMA_BASE_URL=http://10.0.0.128:11434
OLLAMA_MODEL=llama3.2
OLLAMA_EMBED_MODEL=llama3.2

# Email (SMTP2GO)
EMAIL_HOST=mail.smtp2go.com
EMAIL_HOST_USER=replace-with-smtp-user
EMAIL_HOST_PASSWORD=replace-with-smtp-password
EMAIL_PORT=2525
EMAIL_USE_TLS=true

# Captcha
CAPTCHA_SECRET_KEY=replace-with-captcha-secret

# Stripe / finance
STRIPE_SECRET_KEY=replace-with-stripe-secret-key
STRIPE_PUBLISHABLE_KEY=replace-with-stripe-publishable-key
STRIPE_WEBHOOK_SECRET=replace-with-stripe-webhook-secret
# Optional: pre-created Stripe Price ID. When empty, Checkout uses
# SUBSCRIPTION_PRICE_* from settings.py ($10 USD / month by default).
STRIPE_PRICE_ID=
FRONTEND_BASE_URL=https://chat.aimloperations.com
# STRIPE_CHECKOUT_SUCCESS_URL=https://chat.aimloperations.com/billing/success?session_id={CHECKOUT_SESSION_ID}
# STRIPE_CHECKOUT_CANCEL_URL=https://chat.aimloperations.com/billing/cancel

# Gunicorn / ASGI (UvicornWorker for WebSockets)
GUNICORN_WORKERS=2
GUNICORN_BIND=0.0.0.0:8000

# =============================================================================
# BETA overrides (use separate file: chat_backend_beta.env)
# =============================================================================
# DJANGO_ENV=beta
# DJANGO_SECRET_KEY=replace-with-a-different-beta-secret
# DJANGO_ALLOWED_HOSTS=beta.chatbackend.aimloperations.com
# DATABASE_URL=postgres://westfarn:replace-db-password@10.0.0.230:5432/chat_backend_beta
# WEB_PORT=8013
# OLLAMA_BASE_URL=http://10.0.0.128:11434