# Docker service values
POSTGRES_DB=sourcehub
POSTGRES_USER=sourcehub
POSTGRES_PASSWORD=CHANGE_ME
MINIO_ROOT_USER=CHANGE_ME
MINIO_ROOT_PASSWORD=CHANGE_ME_LONG_RANDOM

# SourceHub database
SOURCEHUB_DATABASE_URL=postgresql+psycopg://sourcehub:CHANGE_ME@postgres:5432/sourcehub

# Object storage
SOURCEHUB_STORAGE_BACKEND=minio
SOURCEHUB_MINIO_ENDPOINT=minio:9000
SOURCEHUB_MINIO_ACCESS_KEY=CHANGE_ME
SOURCEHUB_MINIO_SECRET_KEY=CHANGE_ME_LONG_RANDOM
SOURCEHUB_MINIO_BUCKET=nexpa-sourcehub
SOURCEHUB_MINIO_SECURE=false

# Malware scan
SOURCEHUB_MALWARE_SCAN=clamd
SOURCEHUB_CLAMD_HOST=clamav
SOURCEHUB_CLAMD_PORT=3310

# NEXPA Core OIDC
SOURCEHUB_AUTH_MODE=oidc
SOURCEHUB_OIDC_METADATA_URL=CHANGE_ME
SOURCEHUB_OIDC_CLIENT_ID=CHANGE_ME
SOURCEHUB_OIDC_CLIENT_SECRET=CHANGE_ME
SOURCEHUB_OIDC_ROLE_CLAIM=roles

# Security
SOURCEHUB_SESSION_SECRET=CHANGE_ME_64CHAR_RANDOM
SOURCEHUB_SESSION_HTTPS_ONLY=true
SOURCEHUB_CSRF_ENABLED=true
SOURCEHUB_DOWNLOAD_SECRET=CHANGE_ME_ANOTHER_64CHAR_RANDOM
SOURCEHUB_DOWNLOAD_TTL_SECONDS=300
SOURCEHUB_ALLOWED_HOSTS=sourcehub.nexpa-ai.com,localhost,127.0.0.1
SOURCEHUB_ENABLE_HSTS=true

# Gitea (deploy/gitea — host 3200 / SSH 2222)
SOURCEHUB_GITEA_BASE_URL=https://git.nexpa-ai.com
SOURCEHUB_GITEA_TOKEN=CHANGE_ME

# Deployment executor: keep disabled until CI/CD target is explicitly registered
SOURCEHUB_DEPLOY_MODE=disabled
SOURCEHUB_DEPLOY_WEBHOOK_SECRET=CHANGE_ME
SOURCEHUB_DEPLOY_TARGETS_JSON={}