# Application
APP_NAME=Wrapped
APP_ENV=development
APP_SECRET_KEY=change-me-to-a-long-random-string
APP_BASE_URL=http://localhost:8000
LOG_LEVEL=INFO
# Swagger UI (/docs), ReDoc, openapi.json — keep true for local dev
DOCS_ENABLED=true

# Admin (change in production)
ADMIN_USERNAME=admin
ADMIN_PASSWORD=38dmWjE1p

# Postgres
DATABASE_URL=postgresql+asyncpg://wrapped:wrapped@postgres:5432/wrapped

# MinIO / S3
S3_ENDPOINT_URL=http://minio:9000
S3_ACCESS_KEY=wrappedminio
S3_SECRET_KEY=wrappedminio123
S3_BUCKET=wrapped
S3_REGION=us-east-1
S3_USE_SSL=false
S3_CREATE_BUCKET=true

# Optional CAPTCHA secrets (site keys can also be set in admin UI)
TURNSTILE_SECRET_KEY=
HCAPTCHA_SECRET_KEY=

# Client IP / audit: trust these peers for X-Forwarded-For / X-Real-IP.
# Use * only when the app is not publicly reachable (e.g. behind ClusterIP + Ingress).
# Default covers loopback + RFC1918 (Docker Compose nginx, k8s CNI).
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

# Proxies allowed to set X-Forwarded-For / X-Real-IP (audit client IP).
# Use * behind Ingress when only the proxy can reach the app.
# Default covers loopback, RFC1918, and Docker Desktop gateway.
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,192.168.65.0/24

# Client IP / audit: peers allowed to set X-Forwarded-For, X-Real-IP, CF-Connecting-IP.
# Default = loopback + RFC1918 (Docker Desktop gateway, k8s pod CIDRs, local proxies).
# In Kubernetes behind Ingress use * (only the ingress can reach the Service).
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16

# Client IP / audit: peers allowed to set X-Forwarded-For, X-Real-IP, CF-Connecting-IP.
# Use * behind a dedicated ingress (recommended in k8s). Default = loopback + RFC1918.
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16