# Copy to .env (never committed). On the VPS, docker compose reads this file.

# --- database ---
POSTGRES_DB=fintracker
POSTGRES_USER=fintracker
POSTGRES_PASSWORD=change-me
# used by api/worker; inside compose the host is `db`
DATABASE_URL=postgresql+asyncpg://fintracker:change-me@db:5432/fintracker

# --- auth ---
# 32+ random bytes: `openssl rand -hex 32`
JWT_SECRET=change-me
# the API refuses to start with a placeholder/short secret unless ALLOW_DEV_SECRET=1 (dev only)
ACCESS_TOKEN_TTL_SECONDS=3600
REFRESH_TOKEN_TTL_SECONDS=2592000

# --- web ---
DOMAIN=fin.example.com
# comma-separated; leave empty when the Flutter web build is served by Caddy from the same origin
CORS_ORIGINS=
# dev only: serve a Flutter web build from the API process (prod uses Caddy)
WEB_DIR=

# --- sources (filled in later phases) ---
ZENMONEY_TOKEN=
TINVEST_TOKEN=