# NEXPA SourceHub 3.8 Production Candidate
SOURCEHUB_MAX_UPLOAD_MB=500
SOURCEHUB_ALLOWED_HOSTS=localhost,127.0.0.1,sourcehub.nexpa-ai.com

# ---------- Database ----------
# SOURCEHUB_DATABASE_URL=postgresql+psycopg://sourcehub:CHANGE_ME@postgres:5432/sourcehub
SOURCEHUB_DATA_DIR=data

# ---------- Storage ----------
SOURCEHUB_STORAGE_BACKEND=local
SOURCEHUB_STORAGE_DIR=storage
# SOURCEHUB_STORAGE_BACKEND=minio
# SOURCEHUB_MINIO_ENDPOINT=minio:9000
# SOURCEHUB_MINIO_ACCESS_KEY=CHANGE_ME
# SOURCEHUB_MINIO_SECRET_KEY=CHANGE_ME_LONG
# SOURCEHUB_MINIO_BUCKET=nexpa-sourcehub
# SOURCEHUB_MINIO_SECURE=false

# ---------- Authentication ----------
SOURCEHUB_AUTH_MODE=mock
SOURCEHUB_SESSION_SECRET=CHANGE_ME_TO_LONG_RANDOM_VALUE
SOURCEHUB_SESSION_HTTPS_ONLY=false
SOURCEHUB_CSRF_ENABLED=false

# Production OIDC
# SOURCEHUB_AUTH_MODE=oidc
# SOURCEHUB_SESSION_HTTPS_ONLY=true
# SOURCEHUB_CSRF_ENABLED=true
# SOURCEHUB_OIDC_METADATA_URL=https://<NEXPA-CORE>/.well-known/openid-configuration
# SOURCEHUB_OIDC_CLIENT_ID=<CLIENT_ID>
# SOURCEHUB_OIDC_CLIENT_SECRET=<CLIENT_SECRET>
# SOURCEHUB_OIDC_ROLE_CLAIM=roles

# ---------- Download security ----------
SOURCEHUB_DOWNLOAD_SECRET=CHANGE_ME_TO_ANOTHER_LONG_RANDOM_VALUE
SOURCEHUB_DOWNLOAD_TTL_SECONDS=300

# ---------- Malware scan ----------
SOURCEHUB_MALWARE_SCAN=disabled
# SOURCEHUB_MALWARE_SCAN=clamd
# SOURCEHUB_CLAMD_HOST=clamav
# SOURCEHUB_CLAMD_PORT=3310

# ---------- Gitea ----------
SOURCEHUB_GITEA_BASE_URL=https://git.nexpa-ai.com
SOURCEHUB_GITEA_TOKEN=CHANGE_ME

# ---------- Deployment executor ----------
SOURCEHUB_DEPLOY_MODE=disabled
# SOURCEHUB_DEPLOY_MODE=webhook
# SOURCEHUB_DEPLOY_WEBHOOK_SECRET=<LONG_SHARED_SECRET>
# SOURCEHUB_DEPLOY_TARGETS_JSON={"core:PRODUCTION BASELINE":"https://deploy.internal/sourcehub/core"}

# ---------- Security headers ----------
SOURCEHUB_ENABLE_HSTS=false
# Production behind HTTPS: true