# Database
DB_PASSWORD=your_secure_password_here

# API Configuration
API_KEY_SALT=generate_random_salt_with_openssl
CORS_ORIGIN=http://localhost:3001

# Backend runtime (used when starting backend directly, outside Docker Compose)
PORT=3000
DATABASE_URL=postgresql://transit_admin:your_secure_password_here@localhost:5432/polotsk_transit
REDIS_URL=redis://localhost:6379
JWT_SECRET=replace_with_a_long_random_string

# Passkeys (WebAuthn). HTTP works only on localhost; production requires HTTPS.
WEBAUTHN_RP_NAME=RideBus DE
WEBAUTHN_RP_ID=localhost
WEBAUTHN_ORIGIN=http://localhost,http://localhost:3001

# Firebase Cloud Messaging (server-side alert notifications)
# Keep disabled to run without Firebase credentials.
FCM_ENABLED=false
FCM_TOPIC=route_alerts
FCM_ANDROID_CHANNEL_ID=route_alerts
FIREBASE_PROJECT_ID=
# Directory on the Docker host (VM/LXC inside Proxmox), mounted read-only.
FIREBASE_SECRETS_DIR=/opt/polotsk-transit/secrets
# Path inside the backend container. For a direct Node.js launch, replace it
# with the absolute host path to the JSON file.
GOOGLE_APPLICATION_CREDENTIALS=/run/secrets/firebase-service-account.json

# Telegram cancellation import through a separate user account (MTProto).
# Get API credentials at my.telegram.org. Never put a session in the checkout.
TELEGRAM_IMPORT_ENABLED=false
TELEGRAM_AUTO_PUBLISH=true
TELEGRAM_API_ID=
TELEGRAM_API_HASH=
TELEGRAM_CHANNEL=avp2Polotsk
TELEGRAM_CITY_SLUG=polotsk
TELEGRAM_POLL_INTERVAL_MS=60000
# Host directory, mounted read-only into the backend container.
TELEGRAM_SECRETS_DIR=/opt/polotsk-transit/telegram-secrets
# For direct Node.js launches, replace this with the absolute host path.
TELEGRAM_SESSION_FILE=/run/telegram-secrets/account.session

# Bootstrap admin
BOOTSTRAP_ADMIN=true
BOOTSTRAP_ADMIN_RESET_PASSWORD=false
ADMIN_USERNAME=admin
ADMIN_PASSWORD=change_this_admin_password
ADMIN_FULL_NAME=Main administrator
ADMIN_EMAIL=admin@polotsk-transit.local

# Frontend
API_URL=/api/v1

# Required by the passenger telemetry endpoint to verify Firebase ID tokens.
# Use the same Firebase project as the mobile app; keep the service account JSON outside the repo.
FIREBASE_PROJECT_ID=your-firebase-project-id
GOOGLE_APPLICATION_CREDENTIALS=/absolute/private/path/firebase-service-account.json

# Production settings (uncomment for production)
# NODE_ENV=production
# CORS_ORIGIN=https://admin.yourdomain.com
# API_URL=/api/v1
# WEBAUTHN_RP_ID=admin.yourdomain.com
# WEBAUTHN_ORIGIN=https://admin.yourdomain.com