# Stack env for deploy/jorgecuadros-app.stack.yml (PROD).
# Paste these into the Portainer stack's "Environment variables" at deploy time.
# Do NOT commit real secrets — this file is a template only.
#
# HOST below = the swarm host the db/minio/app stacks publish on (cubex).

# Which built image tag to run. latest = default-branch build; or pin sha-<x> / vX.Y.Z.
APP_TAG=latest

# --- Public URLs (what the end user's BROWSER hits) ---------------------------
# API_ORIGIN is OPTIONAL and normally left unset. The browser derives the API
# origin from the page it loaded (apps/web/src/lib/api.ts): same host on port
# 3001 over plain HTTP, or the same-origin /api path when the page is served
# over https by a TLS-terminating proxy that maps /api to the API. That is what
# lets the same deployment move — tailnet, office LAN, demo domain — untouched.
# Set it only when the API genuinely lives on a different host than the web app;
# it is used for browser fetches AND document download links, so it must be
# browser-reachable (never a swarm-internal name).
#API_ORIGIN=http://192.168.4.212:3001
#
# WEB_ORIGIN is the list of public origins the web app is reached under; the API
# allows them via CORS. COMMA-SEPARATED — one deployment is reachable under
# several origins (LAN IP, tailnet name, demo domain) and a credentialed fetch
# from an origin missing here gets no CORS headers and fails. A same-origin
# setup (web + API behind one proxy) never hits CORS at all.
WEB_ORIGIN=http://192.168.4.212:3000

# Published ports on the swarm host.
API_PORT=3001
WEB_PORT=3000

# --- Database (points at the jorgecuadros-prod-db stack) ----------------------
# prod db publishes 3306 on the host (see deploy/jorgecuadros-db.stack.yml).
DATABASE_URL=mysql://jorgecuadros:CHANGE_ME@192.168.4.212:3306/jorgecuadros

# --- Auth --------------------------------------------------------------------
# 64-hex random. Generate: openssl rand -hex 32
SESSION_SECRET=CHANGE_ME

# --- Object storage (points at the jorgecuadros-prod-minio stack) -------------
# Server-side only; prod minio API publishes 9000 on the host.
S3_ENDPOINT=http://192.168.4.212:9000
S3_BUCKET=jorgecuadros-documents
MINIO_ROOT_USER=jc_minio
MINIO_ROOT_PASSWORD=CHANGE_ME

# --- Outbound mail (Amazon SES) ----------------------------------------------
# NOTE: for the Portainer-deployed stacks these do NOT come from a file on the
# host — the deploy workflows build the stack env from Gitea repo secrets (see
# the `env_data` blocks in .gitea/workflows/deploy*.yml). This file documents
# the full variable set and is what you fill in for a hand-run stack.
#
# Either way they are RUNTIME config, read at container boot
# (apps/api/src/mail/mail.service.ts) — never baked into the image.
#
# The production image sets NODE_ENV=production, which turns OFF the stdout dev
# fallback. Leaving these blank does not silently swallow mail — every send
# fails with "El envío de correo no está configurado.", and the failure is
# recorded in the notification log. Fill them in before enabling any envío.
#
# SES_FROM must be a verified SES sending identity.
SES_REGION=us-west-2
SES_FROM=mail@jorgecuadros.com
SES_FROM_NAME=Information Server
SES_ACCESS_KEY=
SES_SECRET_KEY=
# Optional — only needed to publish bounce/complaint events.
SES_CONFIGURATION_SET=

# Recipients of the per-job summary email. NOW EDITABLE IN THE UI
# (/notificaciones > Servicios > "Destinatarios del resumen", ADMIN only), so
# this is only the fallback for a deployment where nobody has set it there.
# A saved value takes precedence and this var is ignored from then on.
NOTIFICATION_ADMIN_EMAILS=rmancinas@freakma.net,mpulido@freakma.net