# Backend (FastAPI) environment reference — copy what you need into the runtime env.
# Real values stay out of git. The dashboard seed login "Admin"/"Admin123" is
# created only when SEED_ADMIN=1.

# SQLite path + reports dir (defaults are fine in Docker; a disk is mounted at /data)
DB_PATH=/data/asianmetal.db
REPORTS_DIR=/data/reports

# CORS allow-list — comma-separated origins of the frontend
ALLOWED_ORIGINS=http://localhost:5174,https://web.didvan.com

# Session cookie: COOKIE_SECURE=1 behind HTTPS; COOKIE_SAMESITE=none for cross-domain
COOKIE_SECURE=0
COOKIE_SAMESITE=lax

# Dangerous development-only seed (Admin/Admin123). Explicitly opt in locally.
SEED_ADMIN=0

# Only these immediate proxy networks may supply X-Real-IP/X-Forwarded-For.
TRUSTED_PROXY_CIDRS=127.0.0.1/32,::1/128,172.16.0.0/12

# Admin panel password (admin_app only)
ADMIN_PASSWORD=change-me-strong-secret

# data-source token for the daily metals/steel sync (sync.py)
ASIANMETAL_TOKEN=

# Optional outbound proxy for geo-blocked sources (only needed on Iran-hosted PaaS;
# the Arvan VPS has direct access and does NOT need these)
# HTTP_PROXY=http://host:port
# HTTPS_PROXY=http://host:port
# SCRAPER_PROXY=http://host:port