# ── Application ─────────────────────────────────────────────────────────────
APP_ENV=development

# ── Frontend (Next.js) ──────────────────────────────────────────────────────
NEXT_PUBLIC_SITE_URL=http://localhost:3000
NEXT_PUBLIC_API_URL=http://localhost:8000/api/v1

# ── Backend (Django) ────────────────────────────────────────────────────────
# development | production
DJANGO_ENV=development
DJANGO_SECRET_KEY=change-me-in-production
DJANGO_DEBUG=true
DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0,backend
# host "postgres"/"redis" match docker-compose service names
DATABASE_URL=postgres://identity:identity@postgres:5432/identity
REDIS_URL=redis://redis:6379/0
# Only needed when a separate origin (a product frontend) calls the API.
CORS_ALLOWED_ORIGINS=http://localhost:8000
CSRF_TRUSTED_ORIGINS=http://localhost:8000

# ── JWT / OIDC (production refuses the dev defaults) ─────────────────────────
# HS256 fallback when no RSA key pair is configured. Must be a real random
# secret (>= 32 bytes) in production — boot fails on the dev default.
JWT_SIGNING_KEY=change-me-in-production
# Public issuer URL embedded in `iss` and advertised via OIDC discovery/JWKS.
# e.g. https://id.example.com — clients validate `iss` against this value.
OIDC_ISSUER=http://localhost:8000

# ── PostgreSQL ───────────────────────────────────────────────────────────────
POSTGRES_DB=identity
POSTGRES_USER=identity
POSTGRES_PASSWORD=identity
POSTGRES_PORT=5432

# ── Redis ────────────────────────────────────────────────────────────────────
REDIS_PORT=6379

# ── SSO ──────────────────────────────────────────────────────────────────────
# Leave SSO_COOKIE_DOMAIN empty on localhost so the session cookie is host-only.
SSO_COOKIE_DOMAIN=
# Hosts allowed as post-login redirect targets (comma-separated). Anything not
# listed here lands on the account page instead.
SSO_TRUSTED_REDIRECT_HOSTS=localhost,127.0.0.1

# ── Outbound email ───────────────────────────────────────────────────────────
EMAIL_FROM_ADDRESS=no-reply@localhost
EMAIL_RESET_PATH=account/reset-password

# ── Outbound SMS ─────────────────────────────────────────────────────────────
# console | kavenegar. Production refuses to start on "console".
SMS_PROVIDER=console
SMS_TIMEOUT=10
KAVENEGAR_API_KEY=
KAVENEGAR_SENDER=

# ── Personal mailbox ─────────────────────────────────────────────────────────
MAIL_DOMAIN=jobid.ir
MAIL_INBOUND_SECRET=
MAIL_DAILY_SEND_LIMIT=200
MAIL_MAX_ATTACH_MB=10

# Media (uploaded attachments). Defaults to apps/api/media when unset; point it
# at a persistent volume in production so mailbox uploads survive a redeploy.
MEDIA_ROOT=