# Generated automatically by scripts/new-docker-env.*. Keep the resulting .env
# private and never commit it.

COMPOSE_PROJECT_NAME=gramsrv-main
TELESRV_DEPLOYMENT_PROFILE=main-monolith-v1
TELESRV_IMAGE_PREFIX=ghcr.io/iamxvbaba/gramsrv
TELESRV_IMAGE_TAG=main
TELESRV_SERVER_BUILD_TARGET=server-test
TELESRV_LOG_LEVEL=info

# Build provenance for local builds.
TELESRV_BUILD_COMMIT=unknown
TELESRV_BUILD_BRANCH=main
TELESRV_BUILD_TREE_STATE=unknown
TELESRV_BUILD_DATE=unknown

# The host-network server and admin reach these dependencies through loopback.
POSTGRES_DB=telesrv_main
POSTGRES_USER=telesrv
POSTGRES_PASSWORD=CHANGEME
TELESRV_POSTGRES_HOST_PORT=15432
TELESRV_POSTGRES_DSN=postgres://telesrv:CHANGEME@127.0.0.1:15432/telesrv_main?sslmode=disable
TELESRV_REDIS_HOST_PORT=16379
TELESRV_REDIS_ADDR=127.0.0.1:16379
TELESRV_REDIS_PASSWORD=CHANGEME

# Independent random values generated for each deployment.
TELESRV_ADMIN_API_TOKEN=CHANGEME
TELESRV_ADMIN_UI_PASSWORD=CHANGEME
TELESRV_ADMIN_UI_TOKEN=
TELESRV_ADMIN_SESSION_KEY=CHANGEME
TELESRV_TURN_SECRET=CHANGEME
TELESRV_OTP_WEBHOOK_SECRET=CHANGEME

# Development delivery is accepted automatically on loopback. Internet-facing
# deployments must explicitly opt in or replace it with the webhook provider.
TELESRV_DEV_AUTH_CODE=12345
TELESRV_PHONE_CODE_DELIVERY_PROVIDER=development
TELESRV_ALLOW_INSECURE_DEVELOPMENT_AUTH=false
TELESRV_OTP_WEBHOOK_URL=
TELESRV_OTP_WEBHOOK_TIMEOUT=5s

# The published main test image deliberately contains a public test RSA key so
# fresh test clients share one fingerprint. Existing server_state is preserved.
# Build target "server" plus mode "generated" for a private deployment identity.
TELESRV_RSA_IDENTITY_MODE=test

# Must be a client-reachable IP address, never a DNS name.
TELESRV_ADVERTISE_IP=CHANGEME
TELESRV_SERVER_PORT=2398
TELESRV_DEFAULT_COUNTRY_CODE=CN
TELESRV_PUBLIC_BASE_URL=CHANGEME
TELESRV_PUBLIC_APP_SCHEME=telesrv
TELESRV_PUBLIC_WEB_BASE_URL=CHANGEME
TELESRV_PUBLIC_LINK_PORT=2401

# The monolith owns SFU, TURN, and RTMP. Host mode avoids one Docker mapping per
# TURN relay port. Bridge mode publishes a bounded 64-port compatibility range.
TELESRV_SERVER_HOST_NETWORK=true
TELESRV_SFU_ENABLE=true
TELESRV_SFU_UDP_PORT=12399
TELESRV_SFU_ADVERTISE_IP=CHANGEME
TELESRV_TURN_ENABLE=true
TELESRV_TURN_UDP_PORT=12400
TELESRV_TURN_ADVERTISE_IP=CHANGEME
TELESRV_TURN_RELAY_MIN_PORT=12500
TELESRV_TURN_RELAY_MAX_PORT=12999
TELESRV_TURN_BRIDGE_RELAY_MAX_PORT=12563
TELESRV_CALL_TURN_CREDENTIAL_TTL=6h
TELESRV_CALL_FORCE_RELAY=false
TELESRV_LIVESTREAM_ENABLE=true
TELESRV_LIVESTREAM_RTMP_PORT=2400
TELESRV_LIVESTREAM_RTMP_URL=CHANGEME

# Direct host listeners and their health-probe addresses.
TELESRV_PUBLIC_BIND_IP=127.0.0.1
TELESRV_PUBLIC_LISTEN_HOST=127.0.0.1
TELESRV_LOCAL_BIND_IP=127.0.0.1
TELESRV_LOCAL_LISTEN_HOST=127.0.0.1
TELESRV_SERVER_HEALTH_IP=127.0.0.1
TELESRV_SERVER_HEALTH_URL_HOST=127.0.0.1
TELESRV_ADMIN_API_PORT=2599
TELESRV_ADMIN_BIND_IP=127.0.0.1
TELESRV_ADMIN_LISTEN_HOST=127.0.0.1
TELESRV_ADMIN_HEALTH_IP=127.0.0.1
TELESRV_ADMIN_PORT=2600

# Durable media state. Switching an existing deployment between localfs and S3
# requires the explicit blob migration procedure.
TELESRV_BLOB_BACKEND=localfs
TELESRV_EXTERNAL_MEDIA_ENABLE=true
TELESRV_WEBPAGE_PREVIEW_ENABLE=true
TELESRV_S3_ENDPOINT=
TELESRV_S3_REGION=
TELESRV_S3_BUCKET=
TELESRV_S3_ACCESS_KEY_ID=
TELESRV_S3_SECRET_ACCESS_KEY=
TELESRV_S3_USE_SSL=true
TELESRV_S3_PATH_STYLE=false
TELESRV_S3_CREATE_BUCKET=false