# Copy to /etc/athena-auth/env and restrict permissions before enabling the service:
#   sudo install -m 0640 -o root -g athena-auth athena-auth.env.example /etc/athena-auth/env
#
# systemd EnvironmentFile values override YAML defaults. The server also reads
# `.env` / `.env.local` from WorkingDirectory (/var/lib/athena-auth) when a
# variable is not already set in the process environment.

# --- Required ---
DATABASE_URL=postgresql://postgres:CHANGE_ME@127.0.0.1:5432/athena_auth
JWT_SECRET=CHANGE_ME_minimum_32_characters_required

# --- HTTP bind ---
HOST=127.0.0.1
PORT=3000

# --- Public URLs (cookies, redirects, passkeys) ---
BASE_URL=https://auth.example.com
AUTH_BASE_PATH=/api/auth
PUBLIC_AUTH_BASE_PATH=/api/auth

# Comma-separated browser origins allowed for CSRF/CORS.
# TRUSTED_ORIGINS=https://app.example.com,https://admin.example.com
# PRIMARY_TRUSTED_ORIGIN=https://app.example.com

# Optional override for sibling-subdomain shared sessions.
# When BASE_URL is https://auth.example.com and all trusted browser origins are
# sibling subdomains like https://app.example.com, Athena Auth auto-derives
# Domain=.example.com for the session cookie. Set this only to override that
# parent-domain default or to disable sharing by leaving it unset and using
# non-sibling origins.
# ATHENA_AUTH_COOKIE_DOMAIN=.example.com

# --- Optional database encryption key ---
# DATABASE_KEY=

# --- Schema detection (writes schema-mapping.generated.yaml under /var/lib/athena-auth) ---
# ATHENA_AUTH_SCHEMA=athena

# --- OAuth (enable providers you need) ---
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=
# APPLE_CLIENT_ID=
# APPLE_CLIENT_SECRET=
# MICROSOFT_CLIENT_ID=
# MICROSOFT_CLIENT_SECRET=

# --- SMTP (required when SMTP_HOST is set) ---
# SMTP_HOST=smtp.example.com
# SMTP_PORT=587
# SMTP_USER=
# SMTP_PASS=
# SMTP_FROM_ADDRESS=noreply@example.com
# SMTP_FROM_NAME=Athena Auth

# --- Passkeys ---
# PASSKEY_RP_ID=auth.example.com
# PASSKEY_RP_NAME=Athena Auth
# PASSKEY_ORIGIN=https://auth.example.com

# --- Observability overrides (defaults live in /etc/athena-auth/config.yaml) ---
# ATHENA_AUTH_GEOIP_API_KEY=
# ATHENA_AUTH_CONFIG__OBSERVABILITY__LOKI__ENABLED=false

# --- Logging ---
# RUST_LOG=info,athena_auth=info,server=info
