# ---- image coordinates ----
REGISTRY=gitea.example.com/vigilcare
IMAGE_TAG=v1.0.0

# ---- exposed ports on the production host ----
API_PORT=5270
GATEWAY_PORT=5081
DASHBOARD_PORT=8080
DASHBOARD_ORIGIN=https://vigilcare.example.com

# ---- external PostgreSQL ----
# Runtime (DML-only) connection used by the API container.
PG_CONNECTION=Host=pg.internal;Port=5432;Database=vigilcare;Username=vigilcare_app;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false
# DDL-privileged connection used ONLY by the EF migration bundle (Step 6 / CD migrate job).
# Never put this credential in the API container environment.
PG_CONNECTION_DDL=Host=pg.internal;Port=5432;Database=vigilcare;Username=vigilcare_migrator;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false
GATEWAY_PG_CONNECTION=Host=pg.internal;Port=5432;Database=vigilcare_ward;Username=vigilcare_app;Password=CHANGE_ME;SSL Mode=Require

# ---- external Redis ----
REDIS_CONNECTION=redis.internal:6379,password=CHANGE_ME,ssl=True,abortConnect=false
GATEWAY_REDIS_CONNECTION=redis.internal:6379,password=CHANGE_ME,ssl=True,abortConnect=false,defaultDatabase=1

# ---- external Seq ----
SEQ_URL=https://seq.internal
SEQ_API_KEY=CHANGE_ME

# ---- external Kafka ----
KAFKA_BOOTSTRAP=kafka1.internal:9093,kafka2.internal:9093,kafka3.internal:9093
KAFKA_REPLICATION_FACTOR=3
KAFKA_SECURITY_PROTOCOL=SaslSsl
KAFKA_SASL_MECHANISM=ScramSha512
KAFKA_SASL_USERNAME=vigilcare
KAFKA_SASL_PASSWORD=CHANGE_ME

# ---- external Elasticsearch ----
ES_URI=https://es.internal:9200
ES_API_KEY=CHANGE_ME
# or ES_USERNAME / ES_PASSWORD

# ---- external RabbitMQ ----
RABBITMQ_HOST=rabbit.internal
RABBITMQ_PORT=5671
RABBITMQ_USERNAME=vigilcare
RABBITMQ_PASSWORD=CHANGE_ME
RABBITMQ_USE_SSL=true
GATEWAY_RABBITMQ_HOST=rabbit.internal
GATEWAY_RABBITMQ_PORT=5671
GATEWAY_RABBITMQ_USERNAME=vigilcare_gw
GATEWAY_RABBITMQ_PASSWORD=CHANGE_ME
GATEWAY_RABBITMQ_USE_SSL=true

# ---- external MinIO ----
MINIO_ENDPOINT=minio.internal:9000
MINIO_ACCESS_KEY=CHANGE_ME
MINIO_SECRET_KEY=CHANGE_ME
MINIO_USE_SSL=true

# ---- application secrets (generate with: openssl rand -base64 48) ----
JWT_SIGNING_KEY=CHANGE_ME_MINIMUM_32_BYTES
# WARNING: rotating PHI_SEARCH_TOKEN_KEY invalidates every stored patient
# search token. See docs/ops/phi-encryption-runbook.md before changing it.
PHI_SEARCH_TOKEN_KEY=CHANGE_ME_32_BYTES
GATEWAY_API_KEY=CHANGE_ME
FHIR_API_KEY=CHANGE_ME
GATEWAY_JWT_SIGNING_KEY=CHANGE_ME_MINIMUM_32_BYTES

# ---- gateway identity ----
GATEWAY_ID=00000000-0000-0000-0000-000000000000
GATEWAY_SITE_ID=00000000-0000-0000-0000-000000000000
GATEWAY_DEPARTMENT=ICU