# Application metadata and runtime environment.
APP_NAME=Todo Modulith API
APP_ENV=production
FRONTEND_URL=http://localhost:3000

# Local service credentials used by Docker Compose.
POSTGRES_USER=postgres
POSTGRES_PASSWORD=
POSTGRES_DB=todo_db
REDIS_PASSWORD=

# Database connection string and SQLAlchemy pool tuning.
DATABASE_URL=
DATABASE_POOL_SIZE=20
DATABASE_MAX_OVERFLOW=10
DATABASE_POOL_TIMEOUT=30
DATABASE_POOL_RECYCLE=3600

# Redis connection used by shared infrastructure such as rate limiting or caching.
REDIS_URL=

# JWT signing secret. Change this in every deployed environment.
SECRET_KEY=

# Maximum request body size in bytes (default 5 MiB).
MAX_REQUEST_SIZE_BYTES=5242880

# JWT signing, validation, and token lifetime settings.
ALGORITHM=HS256
JWT_ISSUER=todo-modulith-api
JWT_AUDIENCE=todo-modulith-client
ACCESS_TOKEN_EXPIRE_MINUTES=30
REFRESH_TOKEN_EXPIRE_MINUTES=10080

# API rate limit rule.
RATE_LIMIT="100/minute"

# CORS settings for browser clients.
CORS_ALLOW_ORIGINS=http://localhost:3000
CORS_ALLOW_METHODS=*
CORS_ALLOW_HEADERS=*

# Content Security Policy header value.
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; frame-ancestors 'none'

# Idempotency key retention time in seconds.
IDEMPOTENCY_TTL_SECONDS=86400

# Account lockout thresholds used to slow repeated failed login attempts.
ACCOUNT_LOCKOUT_MAX_ATTEMPTS=5
ACCOUNT_LOCKOUT_WINDOW_MINUTES=15
ACCOUNT_LOCKOUT_DURATION_MINUTES=15

# CSRF protection toggle.
CSRF_PROTECTION_ENABLED=true

# Logging output format for application logs.
LOG_FORMAT=json

# OpenTelemetry distributed tracing configuration.
# Set OTEL_ENABLED=true and point OTEL_EXPORTER_OTLP_ENDPOINT at a collector to enable tracing.
OTEL_ENABLED=false
OTEL_SERVICE_NAME=fastapi-modulith
OTEL_EXPORTER_OTLP_ENDPOINT=
OTEL_EXPORTER_OTLP_HEADERS=

# Email provider selection. Options: ses, sendgrid, smtp.
EMAIL_PROVIDER=ses

# AWS SES configuration.
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
SES_FROM_EMAIL=noreply@example.com

# SendGrid configuration.
SENDGRID_API_KEY=
SENDGRID_FROM_EMAIL=noreply@example.com

# SMTP configuration for Gmail or other SMTP providers.
SMTP_HOST=
SMTP_PORT=587
SMTP_USERNAME=
SMTP_PASSWORD=
SMTP_FROM_EMAIL=noreply@example.com
SMTP_USE_TLS=true

# Enable multitenant isolation. When false, all data uses a single "Default" tenant.
MULTITENANT_ENABLED=false

# Optional admin and development users created by database seeders.
SEED_ADMIN_EMAIL=
SEED_ADMIN_PASSWORD=
SEED_ADMIN_USERNAME=admin
SEED_ADMIN_FULLNAME=System Administrator
SEED_DEVELOPMENT_USERS_PASSWORD=