# ═══════════════════════════════════════════════════════════════
# IndeeHub — Portainer Stack Environment Variables (Example)
# ═══════════════════════════════════════════════════════════════
#
# Copy to .env.portainer and fill in your values.
# Upload in Portainer: Stacks → Add Stack → "Load variables from .env file"
#
# For local dev: docker compose -f docker-compose.dev.yml up
# ═══════════════════════════════════════════════════════════════

# ── Networking ────────────────────────────────────────────────
DOMAIN=your-domain.com
FRONTEND_URL=https://your-domain.com
APP_PORT=7777

# ── PostgreSQL ────────────────────────────────────────────────
POSTGRES_USER=indeedhub
POSTGRES_PASSWORD=CHANGE_ME_STRONG_PASSWORD
POSTGRES_DB=indeedhub

# ── Redis ─────────────────────────────────────────────────────
REDIS_PASSWORD=CHANGE_ME_STRONG_PASSWORD

# ── MinIO (self-hosted file storage) ──────────────────────────
MINIO_ROOT_USER=indeedhub-minio
MINIO_ROOT_PASSWORD=CHANGE_ME_STRONG_PASSWORD
MINIO_CONSOLE_PORT=9001

# ── MinIO Connection (must match above) ────────────────────────
S3_ENDPOINT=http://minio:9000
AWS_REGION=us-east-1
S3_ACCESS_KEY=indeedhub-minio
S3_SECRET_KEY=CHANGE_ME_STRONG_PASSWORD
S3_PRIVATE_BUCKET=indeedhub-private
S3_PUBLIC_BUCKET=indeedhub-public
S3_PUBLIC_BUCKET_URL=https://your-domain.com/storage/

# ── CloudFront (leave empty — MinIO serves directly) ───────────
CLOUDFRONT_PRIVATE_KEY=
CLOUDFRONT_KEY_PAIR_ID=
CLOUDFRONT_DISTRIBUTION_URL=

# ── BTCPay Server (Bitcoin/Lightning Payments) ───────────────
BTCPAY_URL=https://your-btcpay-server.com
BTCPAY_API_KEY=your_btcpay_api_key
BTCPAY_STORE_ID=your_store_id
BTCPAY_WEBHOOK_SECRET=your_webhook_secret
BTCPAY_ROUTE_HINTS=false

# ── Security Secrets (generate with: openssl rand -hex 32) ────
NOSTR_JWT_SECRET=CHANGE_ME_64_HEX_CHARS
NOSTR_JWT_EXPIRES_IN=7d
AES_MASTER_SECRET=CHANGE_ME_64_HEX_CHARS

# ── SMTP / Email (leave empty to disable) ────────────────────
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
MAIL_FROM=noreply@your-domain.com

# ── SendGrid (leave empty if not using) ───────────────────────
SENDGRID_API_KEY=
SENDGRID_SENDER=

# ── Cognito (not used — Nostr auth only) ──────────────────────
COGNITO_USER_POOL_ID=
COGNITO_CLIENT_ID=

# ── Flash Subscription Secrets (leave empty if not using) ────
FLASH_JWT_SECRET_ENTHUSIAST=
FLASH_JWT_SECRET_FILM_BUFF=
FLASH_JWT_SECRET_CINEPHILE=
FLASH_JWT_SECRET_RSS_ADDON=
FLASH_JWT_SECRET_VERIFICATION_ADDON=

# ── Transcoding API (leave empty — uses built-in FFmpeg) ─────
TRANSCODING_API_KEY=
TRANSCODING_API_URL=

# ── Analytics & Monitoring (leave empty to disable) ──────────
POSTHOG_API_KEY=
SENTRY_ENVIRONMENT=production

# ── DRM (not needed — AES-128 HLS) ───────────────────────────
DRM_SECRET_NAME=
PRIVATE_AUTH_CERTIFICATE_KEY_ID=

# ── Podping (leave empty to disable) ─────────────────────────
PODPING_URL=
PODPING_KEY=
PODPING_USER_AGENT=

# ── Admin Dashboard ───────────────────────────────────────────
ADMIN_API_KEY=CHANGE_ME_STRONG_RANDOM_STRING

# ── Partner Content (leave empty if not using) ────────────────
PARTNER_API_BASE_URL=
PARTNER_API_KEY=