# ---- image coordinates ----
REGISTRY=git.vectur45.com/trent/vigilcare-clinical 
IMAGE_TAG=v1.0.0

# ---- exposed ports on the production host ----
API_PORT=5270
GATEWAY_PORT=5081
DASHBOARD_PORT=8088
DASHBOARD_ORIGIN=https://vigilcare-clinical.vectur45.com
# Gitea Actions var PROD_API_URL (dashboard build) — not read by compose:
# https://api.vigilcare-clinical.vectur45.com


# ---- PostgreSQL (container on the same VM, reached via the shared-service network) ----
# Runtime (DML-only) connection used by the API container.
# "postgres" = the service name in the Postgres compose project - rename to match it exactly.
# Port 5432 is the container's internal port, NOT the 5433 published on the host.
# SSL Mode=Disable: Postgres on the shared-services Docker network has no TLS.
# Use Require only when connecting to a TLS-enabled external Postgres.
PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare;Username=admin;Password=PartyHard753!;SSL Mode=Disable"
# DDL-privileged connection used ONLY by the EF migration bundle (Step 6 / CD migrate job).
# That job currently runs an act_runner container that is NOT joined to shared-service
# (see .gitea/workflows/cd.yml), so it MUST keep using the externally-routable host:port,
# not the container network name, unless that job is later attached to shared-service too.
# Never put this credential in the API container environment.
PG_CONNECTION_DDL="Host=postgres.site.com;Port=5432;Database=vigilcare;Username=admin;Password=PartyHard753!;SSL Mode=Require;Trust Server Certificate=false"
GATEWAY_PG_CONNECTION="Host=postgres;Port=5432;Database=vigilcare_ward;Username=admin;Password=PartyHard753!;SSL Mode=Disable"

# ---- Redis (container on the same VM, reached via the shared-service network) ----
# "redis" = the service name in the Redis compose project - rename to match it exactly.
# Port 6379 is the container's internal port; confirm it matches (it usually does).
REDIS_CONNECTION=redis:6379,abortConnect=false
GATEWAY_REDIS_CONNECTION=redis:6379,abortConnect=false,defaultDatabase=1

# ---- external Seq ----
# On vectur-home-server (Tailscale) - use the ingestion port (5341), not the web UI
# port (8080->80). No TLS is configured, so plain http, not https.
SEQ_URL=http://vectur-home-server:5341
# The compose only sets SEQ_FIRSTRUN_ADMINUSERNAME/PASSWORD for first-run login,
# it does not provision an API key. Generate one manually via Seq's web UI
# (Settings -> API Keys) after the container's first run, then paste it here.
SEQ_API_KEY=CHANGE_ME

# ---- external Kafka ----
# Single-broker cluster on vectur-home-server (Tailscale) - PLAINTEXT only, no SASL.
# Traffic relies on the Tailscale mesh for encryption in transit.
KAFKA_BOOTSTRAP=vectur-home-server:9092
KAFKA_REPLICATION_FACTOR=1
KAFKA_SECURITY_PROTOCOL=Plaintext

# ---- external Elasticsearch ----
# Unauthenticated cluster: leave ES_API_KEY / ES_USERNAME / ES_PASSWORD unset.
# Program.cs only attaches auth when those values are non-empty.
ES_URI=http://vectur-home-server:9200
ES_API_KEY=
# ES_USERNAME=
# ES_PASSWORD=

# ---- external RabbitMQ ----
# Plain AMQP on vectur-home-server (Tailscale) - only 5672 is exposed, no TLS listener.
# RABBITMQ_USERNAME/PASSWORD must match RABBITMQ_DEFAULT_USER/PASS in the RabbitMQ
# compose's own .env on vectur-home-server.
RABBITMQ_HOST=vectur-home-server
RABBITMQ_PORT=5672
RABBITMQ_USERNAME=admin
RABBITMQ_PASSWORD=2va2xcLWTAlRN4abEv3wa7EVawHXk+tnRkQVOOXqs2M=
RABBITMQ_USE_SSL=false
GATEWAY_RABBITMQ_HOST=vectur-home-server
GATEWAY_RABBITMQ_PORT=5672
GATEWAY_RABBITMQ_USERNAME=admin
GATEWAY_RABBITMQ_PASSWORD=2va2xcLWTAlRN4abEv3wa7EVawHXk+tnRkQVOOXqs2M=
GATEWAY_RABBITMQ_USE_SSL=false

# ---- external MinIO ----
# Host publishes the S3 API on 9002 (mapped to container's 9000), no TLS termination.
# MINIO_ACCESS_KEY/SECRET_KEY must match MINIO_ROOT_USER/MINIO_ROOT_PASSWORD in the
# MinIO compose's own .env on vectur-home-server.
MINIO_ENDPOINT=vectur-home-server:9002
MINIO_ACCESS_KEY=admin
MINIO_SECRET_KEY=p3QUh8mXvosfFjrJYJJPd36tGiPbsOASWdIe6FKzdLI=
MINIO_USE_SSL=false

# ---- application secrets (generate with: openssl rand -base64 48) ----
JWT_SIGNING_KEY=T0oK2f3YhBesoMgZnEB7vmi4Dfbd7LxtuemkXI8j3xA=
# WARNING: rotating PHI_SEARCH_TOKEN_KEY invalidates every stored patient
# search token. See docs/ops/phi-encryption-runbook.md before changing it.
PHI_SEARCH_TOKEN_KEY=tbL0Nku3+bK476bv4zmfyRBiiRMTTF3To4Qq9RUOSVg=
GATEWAY_API_KEY=ZxFKE4wUChEg+VzNGM16zFSuHeM+I+IQc59rIzN0U2g=
FHIR_API_KEY=wY29TLNIzLouIEKDu+XAxmZ3T1R5cjE2IIXxaYWpNAg=
GATEWAY_JWT_SIGNING_KEY=TfxbvLz992kr8simlbr8s61W5gKQbLqjyTuPjgCWjV0=

# ---- gateway identity ----
GATEWAY_ID=ce985c14-42de-4db4-8538-c2a203496d9e
GATEWAY_SITE_ID=e9fba67a-fcf5-4966-acb1-dab58a68bff2
GATEWAY_DEPARTMENT=ICU
GATEWAY_CODE=GW-ICU-1
GATEWAY_SITE_CODE=SITE-01
GATEWAY_SITE_NAME=Primary Site
# GATEWAY_SITE_ADDRESS=

# ---- production bootstrap users (API seeds these when missing; not demo accounts) ----
SEED_ADMIN_USERNAME=admin
SEED_ADMIN_PASSWORD="zx+yv8XtbxQq0E5YZ3d8kP5g"
SEED_ADMIN_DISPLAY_NAME=System Admin
SEED_NURSE_USERNAME=nurse
SEED_NURSE_PASSWORD="qcYtKfgLMezlT63AIxrPdmtK"
SEED_NURSE_DISPLAY_NAME=Charge Nurse
SEED_PHYSICIAN_USERNAME=physician
SEED_PHYSICIAN_PASSWORD="msKxpOQIGHK/StlrPIDBx9ZD"
SEED_PHYSICIAN_DISPLAY_NAME=Attending Physician

SIMULATION_ENABLED=true
SIMULATION_RUNNER_PASSWORD=tlIxrcgEEQKh9BYdjZ6/fWwj4TFoN4zTtCUfICrQpxI=