# MQTT Management Platform — example environment file
# Copy to .env and fill in real values. NEVER commit .env to Git.

APP_ENV=development

# --- Management application administrator (spec §7.1) ---
# Only used during initial backend bootstrap; ignored once an admin exists.
ADMIN_INITIAL_USERNAME=admin
ADMIN_INITIAL_PASSWORD=change-me-admin

# --- PostgreSQL ---
DATABASE_USER=mqttadmin
DATABASE_PASSWORD=change-me-db
DATABASE_NAME=mqttadmin
# DATABASE_HOST / DATABASE_PORT are fixed inside compose (mqtt-db:5432);
# listed for local dev runs outside compose.
DATABASE_HOST=mqtt-db
DATABASE_PORT=5432

# --- Secrets ---
# 32+ byte random strings. Generate e.g.:
#   openssl rand -hex 32
SESSION_SECRET=change-me-session-secret-32-bytes-min
SECRET_ENCRYPTION_KEY=change-me-encryption-key-32-bytes

# --- Mosquitto dynamic security bootstrap (spec §7) ---
# Consumed by the dynsec plugin on first broker start (2.1 feature).
MOSQUITTO_DYNSEC_USERNAME=admin
MOSQUITTO_DYNSEC_PASSWORD=change-me-dynsec

# --- Broker connection (backend -> mosquitto, internal network) ---
MOSQUITTO_HOST=mosquitto
MOSQUITTO_MGMT_PORT=1883

# --- Control sidecar ---
# Shared secret between backend and mosquitto-control (backend-net only).
CONTROL_API_TOKEN=change-me-control-token

# --- TLS / PKI defaults (used from Release 2 onwards) ---
DEFAULT_TLS_MIN_VERSION=tlsv1.2
DEFAULT_CERT_VALIDITY_DAYS=365
DEFAULT_CA_VALIDITY_DAYS=3650

# --- Frontend ---
# Non-secret build arg only; see compose.yaml (spec §7.2).
VITE_API_BASE_URL=/api/v1
FRONTEND_PORT=8080