# Local `.env` file used solely for Development purposes.

# --- Image / deployment ------------------------------------------------------

# Host name of the container running the Website service.
HOST_CONTAINER=containers.rock-n-code.com

# Owner of the container running the Website service.
HOST_OWNER=ccn

# Password for authenticating to the container registry.
HOST_PASSWORD=

# Host port mapped to the container's port 8080.
HOST_PORT=8080

# User name for authenticating to the container registry.
HOST_USER=

# Name of the Docker image to pull/run.
IMAGE_NAME=website

# Platform of the deployment image
IMAGE_PLATFORM=linux/amd64

# Platform of the *local* build only (docker-compose.override.yml)
BUILD_PLATFORM=linux/arm64

# Tag of the image to pull/run. 
# Use a semver in production; avoid `latest` so rollbacks are unambiguous.
IMAGE_TAG=latest

# --- Application config ------------------------------------------------------

# Server name reported by the HTTP service.
HTTP_SERVER_NAME=CCNWebsite

# Log verbosity: trace | debug | info | notice | warning | error | critical
LOG_LEVEL=debug

# --- Analytics ---------------------------------------------------------------

# Umami website identifier; empty omits the tracker. Set `String.Analytics.origin`
# and allow it in `security.contentSecurityPolicy` first, or the tracker is blocked.
ANALYTICS_WEBSITE_ID=

# Comma-delimited hosts the tracker reports from; empty reports from every host.
# A host the deployment does not serve drops every visit silently.
ANALYTICS_DOMAINS=

# Whether the pages also embed the session recorder script: true | false
ANALYTICS_RECORDER=false

# --- Security ----------------------------------------------------------------

# `Content-Security-Policy`. Must allow `String.Analytics.origin` in `script-src` and
# `connect-src`, or the tracker is blocked; drop those two once analytics is off.
SECURITY_CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self' https://analytics.rock-n-code.com; connect-src 'self' https://analytics.rock-n-code.com; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

# `X-Content-Type-Options`: disables MIME sniffing.
SECURITY_CONTENT_TYPE_OPTIONS=nosniff

# `X-Frame-Options`: DENY | SAMEORIGIN
SECURITY_FRAME_OPTIONS=DENY

# `Referrer-Policy`.
SECURITY_REFERRER_POLICY=strict-origin-when-cross-origin

# `Permissions-Policy`: denies browser features the site does not use.
SECURITY_PERMISSIONS_POLICY=accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()

# `Strict-Transport-Security`. Left unset: browsers ignore it over plain HTTP but
# remember it stickily once seen, so it stays off in local development.
# SECURITY_STRICT_TRANSPORT_SECURITY=max-age=31536000; includeSubDomains

# --- Persistence -------------------------------------------------------------

# Persistence driver: inMemory (default, no infrastructure) or postgres.
DATABASE_DRIVER=inMemory

# PostgreSQL connection, used when DATABASE_DRIVER=postgres.
DATABASE_HOST=localhost

# Name of the database to connect to.
DATABASE_NAME=ccn

# Provide the real password via the environment or a secret — never commit it.
DATABASE_PASSWORD=ccn

# Maximum pooled connections per event loop, one loop per core — an 8-core host
# can open 8 times this, and every replica that many again.
DATABASE_POOL_MAX_PER_EVENT_LOOP=4

# Port of the database to connect to.
DATABASE_PORT=5432

# TLS posture when connecting: off | prefer | require. Plaintext is the usual
# choice over a private container network; use `require` across one you share.
DATABASE_TLS=off

# Username of the database to connect as.
DATABASE_USERNAME=ccn