# =============================================================================
# Nginx Proxy Manager Platform — Environment Variables
# =============================================================================

MYSQL_ROOT_PASSWORD=rhDGjilZm6XEMJ
MYSQL_DATABASE=npm
MYSQL_USER=npm
MYSQL_PASSWORD=rhDGjilZm6XEMJ

# TZ for container timezone
TZ=America/New_York


# =============================================================================
# WAF Management Platform — Environment Variables
# Copy this file to .env and fill in all CHANGE_ME values before first run.
# Never commit .env to source control.
# =============================================================================

# --- Image version -------------------------------------------------------
# Pin a release tag (e.g. v1.0.0) for reproducible deploys. "latest" tracks
# the newest published image.
WAF_IMAGE_TAG=latest

# --- GeoIP (MaxMind GeoLite2) --------------------------------------------
# Host path to your own GeoLite2-City.mmdb. MaxMind licensing prevents us
# from bundling it. See the README "GeoIP setup" section to obtain one free.
GEOIP_DB_PATH=./GeoLite2-City.mmdb

# --- PostgreSQL ----------------------------------------------------------
POSTGRES_DB=wafdb
POSTGRES_USER=wafuser
POSTGRES_PASSWORD=ioGjIVo4zu4b6Bj
POSTGRES_HOST=postgres
POSTGRES_PORT=5432

# --- Redis ---------------------------------------------------------------
REDIS_URL=redis://redis:6379/0

# --- API Security --------------------------------------------------------
# Generate with: python3 -c "import secrets; print(secrets.token_hex(32))"
SECRET_KEY=ef210e8acc8c0ecdafe3b2096c8923fed5b766d2e86885fa387f3ad600e2de0e

# Comma-separated list of allowed CORS origins (no wildcard).
# For the default local deploy, use the UI's HTTPS URL:
ALLOWED_ORIGINS=https://localhost:8443

# TOTP encryption key — generate with:
#   python3 -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
TOTP_ENCRYPTION_KEY=G1WN75rpulrIprSgn56Ctb8qiXdZM7K2m2FjksRsmu8=

# --- Caddy Admin API (container-internal) --------------------------------
CADDY_ADMIN_URL=http://caddy-waf:2019

# --- SMTP (for alert notifications) --------------------------------------
SMTP_HOST=mail.mmcfetridge.net
SMTP_PORT=465
SMTP_USER=miker@mmcfetridge.net
SMTP_PASSWORD="!Sucyetat123"
SMTP_FROM=miker@mmcfetridge.net

# --- Bootstrap superadmin (seeded on first run only) ---------------------
# Change the password immediately after first login.
BOOTSTRAP_ADMIN_EMAIL=miker@mmcfetridge.net
BOOTSTRAP_ADMIN_PASSWORD=PVGpjJOId5djMO5