# Copy this file to /opt/vigilcare-records/.env on the deploy host (chmod 600).
# CD never uploads or overwrites this file — only the IMAGE_TAG line is patched
# automatically on each release. See docs/26-vigilcare-records-cicd.md.

# ---- image coordinates ----
REGISTRY=git.vectur45.com/trent/vigilcare-records
IMAGE_TAG=v1.0.0

# ---- exposed ports on the production host ----
API_PORT=5217
DASHBOARD_PORT=8089
DASHBOARD_ORIGIN=https://vigilcare-records.vectur45.com

# ---- PostgreSQL ----
# VigilCare Records shares one PostgreSQL instance with VigilCareClinical on the
# same host (see docs/vigilcare-records-clinical-overview.md — "Integrated Database
# Deployment"). "postgres" below is the service name on the "shared-services"
# Docker network already created by VigilCareClinical's own compose project; that
# stack MUST be up before the first `docker compose -f docker-compose.prod.yml up`.
# Runtime (DML-only) connection used by the API container.
PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare_records;Username=vigilcare_records_app;Password=CHANGE_ME;SSL Mode=Disable"
# DDL-privileged connection used ONLY by the EF migration bundle (CD migrate job).
# CD copies migrate-api to the deploy host and runs it in a one-shot container on
# shared-services, so use the same Docker DNS name as PG_CONNECTION (Host=postgres),
# not an external hostname. Store this as Gitea secret PG_CONNECTION_DDL.
# Never put this credential in the API container environment.
PG_CONNECTION_DDL="Host=postgres;Port=5432;Database=vigilcare_records;Username=vigilcare_records_migrator;Password=CHANGE_ME;SSL Mode=Disable"

# ---- Redis (shared-services network) ----
# "redis" = the service name on the shared Redis compose project.
# Use a dedicated logical database so Records' batch-assignment locks never
# collide with VigilCareClinical's own Redis keys.
REDIS_CONNECTION=redis:6379,abortConnect=false,defaultDatabase=2

# ---- MinIO (shared-services network) ----
# "minio" = the service name on the shared MinIO compose project. Records stores
# scanned documents under its own bucket, separate from any clinical buckets.
MINIO_ENDPOINT=minio:9000
MINIO_ACCESS_KEY=admin
MINIO_SECRET_KEY=CHANGE_ME
MINIO_BUCKET_NAME=vigilcare-records-scans
MINIO_USE_SSL=false

# ---- Seq (shared-services network) ----
SEQ_URL=http://seq:80
SEQ_API_KEY=CHANGE_ME

# ---- application secrets (generate with: openssl rand -base64 48) ----
JWT_SECRET=CHANGE_ME_AT_LEAST_32_BYTES
JWT_ISSUER=VigilCareRecords
JWT_AUDIENCE=VigilCareRecords