# ============================================
# Server Panel Backend Configuration
# ============================================

# Application
PANEL_NAME=Server Panel
DEBUG=false
LOG_LEVEL=INFO

# Database (matches docker-compose)
DB_HOST=db
DB_PORT=5432
DB_USER=serverpanel
DB_PASSWORD=serverpanel_secure_password
DB_NAME=serverpanel
DATABASE_URL=postgresql://serverpanel:serverpanel_secure_password@db:5432/serverpanel

# JWT Authentication
SECRET_KEY=your-very-secure-secret-key-change-this-in-production-minimum-32-chars
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=1440

# SSH Configuration
SSH_TIMEOUT=10
DEFAULT_SSH_USER=root
DEFAULT_SSH_PORT=22
# Reject SSH connections to hosts with unknown/changed host keys (mitigates MITM).
# Enable in production once your servers' host keys are in known_hosts.
SSH_REJECT_UNKNOWN_HOSTS=false

# Security
# In production set to your actual domain(s), e.g.: https://panel.example.com
CORS_ORIGINS=*
ALLOWED_HOSTS=localhost,127.0.0.1
# IMPORTANT: Change this before first deployment!
ADMIN_PASSWORD=admin123

# Fernet encryption key for sensitive DB fields (Proxmox passwords, cloud-init passwords).
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# WARNING: Keep this key safe — losing it means losing access to encrypted passwords.
# If not set, passwords are stored as plaintext (insecure).
FERNET_KEY=

# Update Check Configuration
# Note: DISABLE_UPDATE_CHECK and GITHUB_TOKEN are managed via root .env
# (see ../.env.example) and passed in docker-compose. Uncomment below only
# if running backend standalone without compose.
# DISABLE_UPDATE_CHECK=false
# GITHUB_TOKEN=