# =============================================================================
# Django
# =============================================================================
SECRET_KEY=""
# DEBUG defaults to True if unset. Set False in production.
DJANGO_DEBUG=True
# Comma-separated. Include the backend service name for the compose network.
ALLOWED_HOSTS="localhost,127.0.0.1,backend"

# --- Only read when DJANGO_DEBUG=False (production) ---
DJANGO_SECURE_SSL_REDIRECT=
SECURE_HSTS_SECONDS=
# Comma-separated absolute origins, e.g. https://portal.sarlink.net
CSRF_TRUSTED_ORIGINS=""

# =============================================================================
# Database (PostgreSQL) — matches the `database` service in compose.yml
# =============================================================================
POSTGRES_DATABASE=sarlink
POSTGRES_USER=sarlink
POSTGRES_PASSWORD=changeme
POSTGRES_HOST=database
POSTGRES_PORT=5432

# =============================================================================
# Redis — currently optional (CACHES is disabled in settings.py)
# =============================================================================
REDIS_HOST=redis

# =============================================================================
# SMS gateway — OTP + notifications
# =============================================================================
SMS_API_URL=""
SMS_API_KEY=""

# =============================================================================
# ID / person verification — GET {PERSON_VERIFY_BASE_URL}/api/person/{id_card}
# =============================================================================
PERSON_VERIFY_BASE_URL=""

# =============================================================================
# MIB payments — POST {PAYMENT_BASE_URL}/verify-payment
# =============================================================================
PAYMENT_BASE_URL=""

# =============================================================================
# Omada (TP-Link) proxy — device access control (block/unblock)
# =============================================================================
OMADA_PROXY_URL=""
OMADA_PROXY_API_KEY=""
OMADA_SITE_ID=""
OMADA_GROUP_ID=""

# =============================================================================
# MAC vendor lookup — REQUIRED, no default: the "add device" flow errors if unset
# =============================================================================
MACVENDOR_API_URL=""

# =============================================================================
# Telegram bot — admin alerts (optional; falls back to no-op if unset)
# =============================================================================
TG_BOT_TOKEN=""
TG_CHAT_ID=""
# Optional forum topic id. If empty/unset, message_thread_id is omitted and
# messages post to the group's General topic.
TG_TOPIC_ID=""