.env.example

# --- Application ---
APP_ENV=development
PORT=8080
LOG_LEVEL=info
PROCESS_ROLE=all
# Compose overrides PROCESS_ROLE for its two API instances and single worker.


POSTGRES_USER=unity
POSTGRES_PASSWORD=unity
POSTGRES_DB=unity_run_club
POSTGRES_PORT=5432
DATABASE_URL=postgres://unity:unity@localhost:5432/unity_run_club?sslmode=disable
# Container-internal DATABASE_URL points at pgbouncer:6432, not postgres:5432
# directly — see docker-compose.yml. These pgx pool sizes are per API/worker
# replica, cheap because they connect to PgBouncer, not to Postgres itself.
DATABASE_MAX_CONN=20
WORKER_DATABASE_MAX_CONN=10
# DATABASE_MIN_CONN=0
# DATABASE_MAX_CONN_LIFETIME=1h
# DATABASE_MAX_CONN_IDLE_TIME=30m
# Set automatically by compose for api/api-replica/worker; only needed if you
# run the binary directly against a PgBouncer transaction-pooled DATABASE_URL.
# DATABASE_PGBOUNCER_COMPAT=true

PGBOUNCER_MEMORY_LIMIT=64m
PGBOUNCER_CPU_LIMIT=0.25
PGBOUNCER_MAX_CLIENT_CONN=1000
PGBOUNCER_DEFAULT_POOL_SIZE=20

POSTGRES_MEMORY_LIMIT=256m
POSTGRES_CPU_LIMIT=0.75
REDIS_MEMORY_LIMIT=96m
REDIS_CPU_LIMIT=0.25
REDIS_MAXMEMORY=64mb
API_MEMORY_LIMIT=256m
API_CPU_LIMIT=1.0
API_GO_MEMORY_LIMIT=192MiB
API_GO_MAX_PROCS=1
GATEWAY_MEMORY_LIMIT=128m
GATEWAY_CPU_LIMIT=0.25
REALTIME_MEMORY_LIMIT=96m
REALTIME_CPU_LIMIT=0.25
REALTIME_NODE_HEAP_MB=64

# --- Redis ---
REDIS_ADDR=localhost:6379
REDIS_PASSWORD=
REDIS_DB=0

# --- CORS ---
CORS_ALLOWED_ORIGINS=http://localhost:3000

# --- Realtime (Socket.IO) ---
REALTIME_PORT=8081
NEXT_PUBLIC_REALTIME_URL=http://localhost:8081
REALTIME_INTERNAL_URL=http://localhost:8081

# --- Image and file storage ---
OBJECT_STORAGE_PROVIDER=local
# Local fallback; Docker Compose persists this directory in a volume.
UPLOAD_DIR=uploads

# Cloudflare R2 S3 API. The endpoint below is this project's account endpoint
# and bucket; the backend also accepts the endpoint without /unity-runn-club.
R2_ENDPOINT=https://5c9a0fa93f233126f351e90ba5c88e74.r2.cloudflarestorage.com/unity-runn-club
R2_BUCKET=unity-runn-club
R2_ACCESS_KEY_ID=
R2_SECRET_ACCESS_KEY=
R2_PUBLIC_BASE_URL=

# --- Auth (JWT + RBAC) ---
JWT_SECRET=
ACCESS_TOKEN_TTL=15m
REFRESH_TOKEN_TTL=720h
BCRYPT_COST=12

PUBLIC_APP_URL=http://localhost:3000
# GOOGLE_OAUTH_CLIENT_ID=
# GOOGLE_OAUTH_CLIENT_SECRET=
# GOOGLE_OAUTH_REDIRECT_URL=http://localhost:8080/api/v1/auth/google/callback

# --- Notifications (async email pipeline) ---
REMINDER_WINDOW=24h
REMINDER_POLL_INTERVAL=15m
NOTIFICATION_SWEEP_INTERVAL=30s
NOTIFICATION_MAX_ATTEMPTS=5
# Paid registration provider. Use mock only for local development.
PAYMENT_PROVIDER=mock

# Manual bank QR (use PAYMENT_PROVIDER=manual). Paste the raw QR payload here;
# payment is confirmed by an admin after checking the submitted bank reference.
MANUAL_PAYMENT_QR_STRING=
MANUAL_PAYMENT_TTL=24h

# Legacy Bakong provider compatibility (not used by the current manual QR flow).
BAKONG_BASE_URL=
BAKONG_TOKEN=
BAKONG_ACCOUNT_ID=
BAKONG_MERCHANT_ID=
BAKONG_ACQUIRING_BANK=
BAKONG_MERCHANT_NAME=UNITY RUNN CLUB
BAKONG_MERCHANT_CITY=PHNOM PENH
BAKONG_MCC=5999
BAKONG_STORE_LABEL=UNITY RUNN CLUB
BAKONG_TERMINAL_LABEL=WEB
BAKONG_PAYMENT_TTL=10m

# --- Rate limiting (Redis fixed window) ---
# Defaults below match the values hardcoded before these became configurable.
# RATE_LIMIT_LOGIN_MAX=10
# RATE_LIMIT_LOGIN_WINDOW=15m
# RATE_LIMIT_REGISTRATION_MAX=5
# RATE_LIMIT_REGISTRATION_WINDOW=1m
# RATE_LIMIT_EVENTS_READ_MAX=100
# RATE_LIMIT_EVENTS_READ_WINDOW=1m
# RATE_LIMIT_PAYMENT_VERIFY_MAX=5
# RATE_LIMIT_PAYMENT_VERIFY_WINDOW=1m

# --- Metrics ---
# Served on a separate, Docker-network-only port — never published through
# Traefik. Scrape it from another container on the same network.
METRICS_PORT=9091