# Copy to .env and adjust. Every value here can also be supplied as a real
# environment variable (which takes precedence over the .env file).

# --- General ---
APP_NAME="FastAPI Skeleton"
DEBUG=false

# --- Security ---
# Generate a strong value, e.g. `python -c "import secrets; print(secrets.token_urlsafe(48))"`
SECRET_KEY="change-me-please-use-a-long-random-string"
ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=15
REFRESH_TOKEN_EXPIRE_DAYS=7

# --- Database ---
# SQLite (zero-setup default):
DATABASE_URL="sqlite+aiosqlite:///./app.db"
# Postgres example:
# DATABASE_URL="postgresql+asyncpg://app:app@localhost:5432/app"

# Create tables on startup (handy for dev/SQLite; use Alembic in production).
AUTO_CREATE_TABLES=true

# --- Web / cookies ---
COOKIE_NAME=access_token
# Set true when serving over HTTPS.
COOKIE_SECURE=false

# --- CORS (JSON list) ---
CORS_ORIGINS=["*"]

# --- LDAP / Active Directory (optional) ---
# When enabled, login credentials are validated against the directory and a
# local user is provisioned on first login. Local DB auth still works as a
# fallback (so the seeded superuser can log in). Disabled by default.
LDAP_ENABLED=false
LDAP_SERVER_URI="ldap://ldap.example.com:389"
LDAP_USE_SSL=false
LDAP_START_TLS=false
LDAP_TLS_VALIDATE=true
# LDAP_CA_CERTS_FILE="/etc/ssl/certs/ca.pem"

# Option 1 — direct bind: build the user DN from the login name.
# LDAP_BIND_DN_TEMPLATE="uid={username},ou=people,dc=example,dc=com"

# Option 2 — search + bind: a service account finds the user, then we bind as
# the found DN. Leave the template above empty to use this mode.
# LDAP_BIND_DN="cn=svc-reader,dc=example,dc=com"
# LDAP_BIND_PASSWORD="service-account-password"
# LDAP_USER_SEARCH_BASE="ou=people,dc=example,dc=com"
# LDAP_USER_SEARCH_FILTER="(uid={username})"

# Directory attributes copied onto the local user, and roles granted on first login.
LDAP_ATTR_EMAIL=mail
LDAP_ATTR_FULL_NAME=cn
LDAP_DEFAULT_ROLES=["user"]

# --- Bootstrap superuser (used by scripts/seed.py) ---
FIRST_SUPERUSER_EMAIL=admin@example.com
FIRST_SUPERUSER_PASSWORD=changethis