# ============================================
# Server Panel Backend Configuration
# ============================================

# Application
PANEL_NAME=Server Panel
DEBUG=false
LOG_LEVEL=INFO

# Database (matches docker-compose)
DB_HOST=db
DB_PORT=5432
DB_USER=serverpanel
DB_PASSWORD=serverpanel_secure_password
DB_NAME=serverpanel
DATABASE_URL=postgresql://serverpanel:serverpanel_secure_password@db:5432/serverpanel

# JWT Authentication
# Must be replaced (>= 32 random chars, e.g. `openssl rand -hex 32`): the panel
# refuses to start with this placeholder, since anyone could forge tokens with it.
SECRET_KEY=your-very-secure-secret-key-change-this-in-production-minimum-32-chars
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=1440

# SSH Configuration
SSH_TIMEOUT=10
DEFAULT_SSH_USER=root
DEFAULT_SSH_PORT=22
# Node host keys are pinned on the first SSH connection (trust on first use);
# a changed key is refused until it is reset on the server card ("Reset SSH
# host key"), e.g. after a node reinstall. Pins live in SSH_KNOWN_HOSTS_FILE
# (default: /app/data/ssh_known_hosts on the data volume).
# SSH_KNOWN_HOSTS_FILE=/app/data/ssh_known_hosts
# Strict mode: also refuse hosts that are neither pinned nor in known_hosts.
SSH_REJECT_UNKNOWN_HOSTS=false

# Security
# Public URL of the panel. Used for links in e-mails (password reset) — when
# unset, the link is built from request headers, which a client can forge.
# deploy.sh fills it in when a domain is configured.
# PANEL_URL=https://panel.example.com
# In production set to your actual domain(s), e.g.: https://panel.example.com
CORS_ORIGINS=*
ALLOWED_HOSTS=localhost,127.0.0.1
# IMPORTANT: Change this before first deployment!
ADMIN_PASSWORD=admin123

# Fernet encryption key for sensitive DB fields (Proxmox passwords, cloud-init passwords).
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
# WARNING: Keep this key safe — losing it means losing access to encrypted passwords.
# If not set, passwords are stored as plaintext (insecure).
FERNET_KEY=

# Update Check Configuration
# Note: DISABLE_UPDATE_CHECK and GITHUB_TOKEN are managed via root .env
# (see ../.env.example) and passed in docker-compose. Uncomment below only
# if running backend standalone without compose.
# DISABLE_UPDATE_CHECK=false
# GITHUB_TOKEN=

# App Store (модуль каталога self-hosted приложений)
# Золотой LXC-шаблон (vztmpl) с предустановленным Docker — из него клонируются
# контейнеры приложений. Обязателен для установки. Подготовка: docs/golden-template.md.
APPSTORE_GOLDEN_TEMPLATE=local:vztmpl/golden-docker_12_amd64.tar.zst
# Архитектура целевых нод (amd64|arm64) — для пометки неподдерживаемых приложений.
APPSTORE_HOST_ARCH=amd64
#
# Источники каталога (через запятую): runtipi, umbrel. По умолчанию только
# runtipi. Umbrel включается явно — тогда при синхронизации подтянутся ~380
# приложений из getumbrel/umbrel-apps + их иконки из галереи.
#   APPSTORE_SOURCES=runtipi,umbrel
APPSTORE_SOURCES=runtipi
# Репозитории Umbrel (нужны только если включён источник umbrel):
# UMBREL_APPSTORE_REPO=getumbrel/umbrel-apps
# UMBREL_APPSTORE_REF=master
# Иконки Umbrel лежат отдельно (<app-id>/icon.svg) — тянутся пофайлово с CDN:
# UMBREL_APPSTORE_GALLERY_CDN=https://getumbrel.github.io/umbrel-apps-gallery