# Copy this file to the project root as .env.production on the NAS.
# Keep the copied file private and never commit it.

# Synology MariaDB 10 package. Confirm its TCP port in the package settings;
# 3307 is the common Synology default.
# NAS end of the dedicated Compose bridge. Container localhost is not the NAS.
# If you change the Compose subnet, update this address and the SQL host grant.
DB_HOST=172.29.240.1
DB_PORT=3307
DB_NAME=model_delivery
DB_USER=model_app
DB_PASSWORD=REPLACE_WITH_A_UNIQUE_DATABASE_PASSWORD

# API loopback is shared with the gateway via network_mode: service:gateway.
# Keep these values; Web Station selects gateway container port 38080.
API_HOST=127.0.0.1
API_PORT=3001
LOG_LEVEL=info

# Replace both origins with the exact HTTPS addresses configured in DSM.
# The second origin is the LAN-only administration portal.
COOKIE_SECURE=true
APP_ORIGINS=https://deliveries.example.com,https://deliveries-admin.example.com

# Generate once and preserve for the life of this database. Losing or changing
# it makes saved SSO, directory credentials and provider tokens unreadable.
TOKEN_ENCRYPTION_KEY=REPLACE_WITH_32_RANDOM_BYTES_IN_BASE64

# One-time code used to create the single recovery administrator account.
LOCAL_ADMIN_SETUP_TOKEN=REPLACE_WITH_A_LONG_RANDOM_SETUP_CODE

# These can remain blank and be entered through the LAN-only /local-admin UI.
OIDC_ISSUER=
OIDC_DISCOVERY_URL=
OIDC_CLIENT_ID=
OIDC_CLIENT_SECRET=
OIDC_REDIRECT_URI=https://deliveries.example.com/api/auth/callback
OIDC_SCOPES=openid groups
OIDC_ALLOW_HTTP=false