# Template for the app stack's .env. The workspace root's scripts/setup.sh copies
# this file to .env on first run and then keeps the shared keys in sync with the
# root .env. Secrets stay as `changethis` here and are generated locally.

# Domain Traefik routes on and acquires TLS certificates for.
DOMAIN=localhost

# The address people and devices reach this instance at: device links, mails
# and the MCP issuer are built from it.
FRONTEND_HOST=http://localhost:5173

# local, staging, production
ENVIRONMENT=local

PROJECT_NAME="Fluksio"
STACK_NAME=fluksio-app

# Backend. The image serves the dashboard on the API's own origin, so these
# only matter to a dashboard served from elsewhere, such as the Vite server.
BACKEND_CORS_ORIGINS="http://localhost,http://localhost:5173,http://app.localhost,https://localhost,https://localhost:5173"
SECRET_KEY=changethis
FIRST_SUPERUSER=admin@fluksio.com
FIRST_SUPERUSER_PASSWORD=changethis

# Emails
SMTP_HOST=
SMTP_USER=
SMTP_PASSWORD=
EMAILS_FROM_EMAIL=info@fluksio.com
SMTP_TLS=True
SMTP_SSL=False
SMTP_PORT=587

# Where this instance keeps everything: the database, flows, secrets,
# artifacts and the user venv. The compose stack sets it to the /data volume.
DATA_DIR=flow-data
# Any SQLAlchemy URL. Empty means SQLite in the data directory, which is what
# the engine is designed around — one process owns this database.
DATABASE_URL=

# The Postgres the optional Umami analytics profile runs on. Nothing else uses
# it; `make umami` provisions a least-privilege role inside it.
POSTGRES_DB=app
POSTGRES_USER=postgres
POSTGRES_PASSWORD=changethis

# Redis — flow engine state. Empty keeps the state in memory in a checkout, and
# the image starts a Redis of its own; the compose stack points the backend at
# its own `redis` service.
REDIS_HOST=
REDIS_PORT=6379

SENTRY_DSN=

# Docker registry image
DOCKER_IMAGE_BACKEND=fluksio-backend
# Optional features built into it, comma separated: mqtt, influx, email,
# sentry, ml, or server for all of them. Empty is the minimal engine.
EXTRAS=server

# The MCP endpoint agents connect to, and the OAuth server behind it.
MCP_ENABLED=true

# Self-service accounts from the login page. Off: a superuser adds accounts
# under Admin.
SIGNUP_ENABLED=false

# Local time for schedules; set from the root .env by scripts/setup.sh.
TZ=UTC