# Copy this file to .env for local operations only. Never commit populated values.

# NAS deployment target
DSM_HOST=
DSM_SSH_PORT=22
DSM_SSH_USER=
DSM_SSH_PASSWORD=
NAS_DEPLOY_ROOT=/volume1/docker/d3ro-voice
NAS_ADMIN_PORT=5000
NAS_LANDING_PORT=4321

# Git/Forgejo operations
GIT_SERVER_URL=https://git.example.invalid
GIT_USERNAME=
GIT_PASSWORD=
GIT_REPO_NAME=d3ro-voice
FORGEJO_TOKEN=
FORGEJO_USERNAME=
FORGEJO_PASSWORD=

# Public service addresses
APP_DOMAIN=voice.example.invalid
ADMIN_DOMAIN=admin.voice.example.invalid
API_SERVER_URL=https://voice.example.invalid
SITE_URL=https://voice.example.invalid
CORS_ALLOWED_ORIGINS=https://voice.example.invalid,https://admin.voice.example.invalid
ALLOWED_HOSTS=voice.example.invalid;admin.voice.example.invalid

# API authentication. Generate unique random values for every environment.
# JWT_SECRET and ADMIN_SESSION_SECRET must each be at least 32 UTF-8 bytes.
JWT_SECRET=
JWT_ISSUER=https://voice.example.invalid
JWT_AUDIENCE=d3ro-admin
ADMIN_BOOTSTRAP_TOKEN=
ADMIN_SESSION_SECRET=
# TLS 없이 LAN HTTP(예: http://NAS_IP:3001)로 직접 접속하는 배포에서만 false로 설정.
# Secure 쿠키는 HTTP에서 브라우저가 버려 로그인이 유지되지 않는다. 기본값 true 유지 권장.
ADMIN_COOKIE_SECURE=true
# Shared only between Supabase stt-proxy and the .NET provider orchestrator.
# Use a distinct random value with at least 32 UTF-8 bytes.
D3RO_API_TOKEN=

# Offline Ed25519 license keys. Keep the private key on the admin server only.
# The matching public key is committed at apps/desktop/resources/license/production-public.pem.
# Multiline private PEM values may use escaped \n characters. Legacy fixture keys are development-only.
ADMIN_LICENSE_PRIVATE_KEY=
D3RO_ALLOW_LEGACY_DEV_LICENSES=false

# Supabase
SUPABASE_URL=
SUPABASE_SERVICE_ROLE_KEY=

# Google OAuth and browser automation
GOOGLE_OAUTH_CLIENT_ID=
GOOGLE_OAUTH_SECRET=
D3RO_PORTAL_OPERATOR_EMAIL=

# Android release signing. Prefer Gradle properties or a protected CI secret store.
D3RO_RELEASE_STORE_FILE=
D3RO_RELEASE_STORE_PASSWORD=
D3RO_RELEASE_KEY_ALIAS=
D3RO_RELEASE_KEY_PASSWORD=

# Google Mobile Ads production identifiers. These are identifiers, not secrets,
# but release builds intentionally fail when they are absent or use test IDs.
D3RO_ADMOB_APP_ID=
D3RO_ADMOB_BANNER_UNIT_ID=
D3RO_ADMOB_REWARDED_UNIT_ID=

# Email and push providers
RESEND_FROM=
RESEND_API_KEY=
FCM_SERVICE_ACCOUNT_JSON=
FCM_PROJECT_ID=

# Optional authenticated mobile E2E account, stored only in CI secrets or local .env.
MOBILE_E2E_EMAIL=
MOBILE_E2E_PASSWORD=