# Copy to deploy/.env and fill in real values — NEVER commit the real .env.
# Consumed by deploy/docker-compose.yml on the self-hosted VPS.

# Admin-panel (admin_app) password — required only if you run the admin service.
ADMIN_PASSWORD=change-me-strong-secret

# Public origin of the deployed site (used for the CORS allow-list).
# e.g. http://94.101.187.12  or  https://yourdomain.ir
PUBLIC_ORIGIN=http://your-server-ip

# data-source token for the daily metals/steel sync (rotates ~every 4 days).
# Leave blank until you have a current one.
ASIANMETAL_TOKEN=

# SSO shared secret. MUST be byte-identical to the steelforesight panel's
# SSO_SECRET — anyone holding it can mint a login token for any email. If unset,
# SSO degrades to the normal login page (no crash).
SSO_SECRET=

# Bearer token for the internal /api/v1 data API (parent org). Anyone holding it
# can read all price data. If unset, /api/v1 returns 503. Generate with e.g.
# `python -c "import secrets; print(secrets.token_urlsafe(24))"`.
API_TOKEN=