# ─── Domain ───────────────────────────────────────────────────────────────────
# The public domain Traefik routes to this app (no https://, no trailing slash).
DOMAIN=yourdomain.com

# ─── Postgres ─────────────────────────────────────────────────────────────────
POSTGRES_USER=studioflow
POSTGRES_PASSWORD=change_me_strong_password
POSTGRES_DB=studioflow

# ─── Redis ────────────────────────────────────────────────────────────────────
REDIS_PASSWORD=change_me_strong_password

# ─── JWT secrets (generate with: openssl rand -base64 48) ─────────────────────
JWT_SECRET=change_me_min_32_chars_xxxxxxxxxxxxxxxxxx
JWT_REFRESH_SECRET=change_me_min_32_chars_refresh_xxxxxxxx

# ─── YouTube token encryption — MUST be exactly 32 characters ─────────────────
# Generate with: openssl rand -hex 16
TOKEN_ENCRYPTION_KEY=change_me_exactly_32chars_key_xxxx

# ─── Google OAuth / YouTube API ───────────────────────────────────────────────
# Create OAuth 2.0 credentials at https://console.cloud.google.com/
# Authorised redirect URI must match GOOGLE_CALLBACK_URL exactly.
GOOGLE_CLIENT_ID=your_client_id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your_client_secret
GOOGLE_CALLBACK_URL=https://yourdomain.com/api/v1/auth/google/callback

# ─── App URLs ─────────────────────────────────────────────────────────────────
# Public URL of the frontend — used by the API for CORS.
FRONTEND_URL=https://yourdomain.com

# ─── Conflict detection (worker) ──────────────────────────────────────────────
# Global kill switch for the scheduled remote-conflict sweep.
# Per-team opt-in and batch limits are configured in Team settings.
CONFLICT_DETECTION_ENABLED=false
CONFLICT_DETECTION_CRON=0 3 * * *