# Shared by every Schulcloud app in the stack.
# Everything in this directory is local-only and deliberately non-secret.

NODE_ENV=production
NO_COLOR=true
TZ=Europe/Berlin

# --- identity of this instance -------------------------------------------
# Mirrors dof_app_deploy/ansible/group_vars/thr/instance_cfg.yml so the local
# instance looks and behaves like schulcloud-thueringen.de.
SC_THEME=thr
SC_SHORTNAME=thr
SC_TITLE=Thüringer Schulcloud
SC_PRODUCTNAME=Thüringer Schulcloud
SC_NAV_TITLE=Thüringer Schulcloud
SC_CONTACT_EMAIL=schulcloud-support@thillm.de
ACCESSIBILITY_REPORT_EMAIL=institut@thillm.de

# The single origin the browser talks to (the nginx in ./proxy).
SC_DOMAIN=localhost:4400
HOST=http://localhost:4400
# The API stamps SC_DOMAIN into every JWT as both issuer and audience. The
# satellite services (file-storage, h5p) validate iss/aud against JWT_DOMAIN,
# which defaults to a bare "localhost" — so without this they reject every
# token the API issued and the homework page's file lookups 401. Keep the two
# in lockstep.
JWT_DOMAIN=localhost:4400
PUBLIC_BACKEND_URL=http://localhost:4400/api
CTL_TOOLS_BACKEND_URL=http://localhost:4400/api

# --- infrastructure ------------------------------------------------------
DB_URL=mongodb://mongo:27017/schulcloud
DB_ENSURE_INDEXES=true
RABBITMQ_URI=amqp://guest:guest@rabbitmq:5672

# The JWT whitelist. `single` reproduces production: every authenticated
# request re-sets a Valkey key with a JWT_TIMEOUT_SECONDS TTL, and losing that
# key logs the session out. `in-memory` would hide that behaviour entirely,
# which is exactly the behaviour this instance exists to test.
SESSION_VALKEY__MODE=single
SESSION_VALKEY__URI=redis://valkey:6379
JWT_TIMEOUT_SECONDS=7200
JWT_SHOW_TIMEOUT_WARNING_SECONDS=3600

AES_KEY=randomStringWithAtLeast16Chars;
S3_KEY=abcdefghijklmnop