# ---- image coordinates ----
REGISTRY=gitea.example.com/vigilcare
IMAGE_TAG=v1.0.0

# ---- exposed ports on the production host ----
API_PORT=5270
GATEWAY_PORT=5081
DASHBOARD_PORT=8088
DASHBOARD_ORIGIN=https://vigilcare-clinical.vectur45.com
# Set Gitea Actions variable PROD_API_URL to the public API origin (baked into
# the dashboard image at build). Example:
#   PROD_API_URL=https://api.vigilcare-clinical.vectur45.com
# Gateway public host (nginx only; compose keeps CentralApi on the Docker network):
#   https://gateway.vigilcare-clinical.vectur45.com

# ---- external PostgreSQL ----
# Runtime (DML-only) connection used by the API container.
PG_CONNECTION=Host=pg.internal;Port=5432;Database=vigilcare;Username=vigilcare_app;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false
# DDL-privileged connection used ONLY by the EF migration bundle (Step 6 / CD migrate job).
# Never put this credential in the API container environment.
PG_CONNECTION_DDL=Host=pg.internal;Port=5432;Database=vigilcare;Username=vigilcare_migrator;Password=CHANGE_ME;SSL Mode=Require;Trust Server Certificate=false
GATEWAY_PG_CONNECTION=Host=pg.internal;Port=5432;Database=vigilcare_ward;Username=vigilcare_app;Password=CHANGE_ME;SSL Mode=Require

# ---- external Redis ----
REDIS_CONNECTION=redis.internal:6379,password=CHANGE_ME,ssl=True,abortConnect=false
GATEWAY_REDIS_CONNECTION=redis.internal:6379,password=CHANGE_ME,ssl=True,abortConnect=false,defaultDatabase=1

# ---- external Seq ----
SEQ_URL=https://seq.internal
SEQ_API_KEY=CHANGE_ME

# ---- external Kafka ----
KAFKA_BOOTSTRAP=kafka1.internal:9093,kafka2.internal:9093,kafka3.internal:9093
KAFKA_REPLICATION_FACTOR=3
KAFKA_SECURITY_PROTOCOL=SaslSsl
KAFKA_SASL_MECHANISM=ScramSha512
KAFKA_SASL_USERNAME=vigilcare
KAFKA_SASL_PASSWORD=CHANGE_ME

# ---- external Elasticsearch ----
ES_URI=https://es.internal:9200
ES_API_KEY=CHANGE_ME
# or ES_USERNAME / ES_PASSWORD

# ---- external RabbitMQ ----
RABBITMQ_HOST=rabbit.internal
RABBITMQ_PORT=5671
RABBITMQ_USERNAME=vigilcare
RABBITMQ_PASSWORD=CHANGE_ME
RABBITMQ_USE_SSL=true
GATEWAY_RABBITMQ_HOST=rabbit.internal
GATEWAY_RABBITMQ_PORT=5671
GATEWAY_RABBITMQ_USERNAME=vigilcare_gw
GATEWAY_RABBITMQ_PASSWORD=CHANGE_ME
GATEWAY_RABBITMQ_USE_SSL=true

# ---- external MinIO ----
MINIO_ENDPOINT=minio.internal:9000
MINIO_ACCESS_KEY=CHANGE_ME
MINIO_SECRET_KEY=CHANGE_ME
MINIO_USE_SSL=true

# ---- application secrets (generate with: openssl rand -base64 48) ----
JWT_SIGNING_KEY=CHANGE_ME_MINIMUM_32_BYTES
# WARNING: rotating PHI_SEARCH_TOKEN_KEY invalidates every stored patient
# search token. See docs/ops/phi-encryption-runbook.md before changing it.
PHI_SEARCH_TOKEN_KEY=CHANGE_ME_32_BYTES
GATEWAY_API_KEY=CHANGE_ME
FHIR_API_KEY=CHANGE_ME
GATEWAY_JWT_SIGNING_KEY=CHANGE_ME_MINIMUM_32_BYTES

# ---- gateway identity ----
GATEWAY_ID=00000000-0000-0000-0000-000000000000
GATEWAY_SITE_ID=00000000-0000-0000-0000-000000000000
GATEWAY_DEPARTMENT=ICU
GATEWAY_CODE=GW-ICU-1
GATEWAY_SITE_CODE=SITE-01
GATEWAY_SITE_NAME=Primary Site
# GATEWAY_SITE_ADDRESS=

# ---- production bootstrap users (API seeds when missing; change before first deploy) ----
SEED_ADMIN_USERNAME=admin
SEED_ADMIN_PASSWORD=CHANGE_ME
SEED_ADMIN_DISPLAY_NAME=System Admin
SEED_NURSE_USERNAME=nurse
SEED_NURSE_PASSWORD=CHANGE_ME
SEED_NURSE_DISPLAY_NAME=Charge Nurse
SEED_PHYSICIAN_USERNAME=physician
SEED_PHYSICIAN_PASSWORD=CHANGE_ME
SEED_PHYSICIAN_DISPLAY_NAME=Attending Physician

# ---- clinical simulation (UAT / training; leave enabled only on synthetic data) ----
SIMULATION_ENABLED=true
SIMULATION_RUNNER_PASSWORD=CHANGE_ME
# SIMULATION_MAX_CONCURRENT_RUNS=8