############################################################
# MC Cars - self-hosted Supabase + web
# Dev defaults. ROTATE EVERY SECRET before any non-local deploy.
############################################################

# ---- Postgres ----
POSTGRES_HOST=db
POSTGRES_DB=postgres
POSTGRES_PORT=5432
POSTGRES_PASSWORD=mc-cars-local-postgres-password

# ---- JWT ----
# Well-known demo values from Supabase self-hosting guide (local-only).
# Replace with values generated from JWT_SECRET on any real deployment.
JWT_SECRET=super-secret-jwt-token-with-at-least-32-characters-long
JWT_EXPIRY=3600
ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6ImFub24iLCJleHAiOjE5ODM4MTI5OTZ9.CRXP1A7WOeoJeXxjNni43kdQwgnWNReilDMblYTn_I0
SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZS1kZW1vIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImV4cCI6MTk4MzgxMjk5Nn0.EGIM96RAZx35lJzdJsyH-qQwv8Hdp7fsn3W0YpN81IU

# ---- Studio basic-auth (behind Kong) ----
DASHBOARD_USERNAME=supabase
DASHBOARD_PASSWORD=mc-cars-studio

# ---- Public URLs (as seen from the browser) ----
SITE_URL=http://localhost:8080
API_EXTERNAL_URL=http://localhost:54321
SUPABASE_PUBLIC_URL=http://localhost:54321

# ---- GoTrue (Auth) ----
GOTRUE_SITE_URL=http://localhost:8080
GOTRUE_URI_ALLOW_LIST=http://localhost:8080,http://localhost:8080/admin.html
DISABLE_SIGNUP=true
ENABLE_EMAIL_SIGNUP=true
ENABLE_EMAIL_AUTOCONFIRM=true
ENABLE_ANONYMOUS_USERS=false

# ---- SMTP (dummy; real values needed only to send password-reset mail) ----
SMTP_HOST=localhost
SMTP_PORT=2500
SMTP_USER=fake
SMTP_PASS=fake

# ---- Admin BOOTSTRAP credentials (seeded on first DB init) ----
# The user is flagged must_change_password=true. The REAL working password
# is set by the admin via the UI on first login and never equals this seed.
ADMIN_EMAIL=admin@mccars.local
ADMIN_PASSWORD=mc-cars-admin

# ---- Storage ----
STORAGE_BACKEND=file
FILE_SIZE_LIMIT=52428800