# ============================================================
# «Контракт-чек» — production config (see docs/ARCHITECTURE.md §11)
# Copy to `.env` and fill in. All config is 12-factor (env-driven).
# ============================================================

# --- Runtime ---
ENV=dev                       # dev | staging | prod
LOG_LEVEL=INFO
LOG_FORMAT=json               # json (prod/staging) | console (dev)
APP_VERSION=0.1.0             # added to every log line; set at build/deploy time

# --- Postgres (async) ---
DATABASE_URL=postgresql+asyncpg://contract_check:contract_check@postgres:5432/contract_check

# --- Redis (rate-limit / sessions, future; NOT the job queue) ---
REDIS_URL=redis://redis:6379/0

# --- RabbitMQ (job queue pipeline) ---
RABBITMQ_URL=amqp://contract_check:contract_check@rabbitmq:5672//
MQ_PREFETCH_EXTRACT=1         # CPU-bound extraction; tune to CPU count
MQ_PREFETCH_ANALYZE=3         # mirrors Ollama Pro concurrency
MQ_PREFETCH_NOTIFY=5          # notification worker (I/O bound)
MQ_MAX_ATTEMPTS=5             # before a message lands on the DLQ
MQ_RETRY_BASE_MS=2000         # exponential backoff base (2s, 4s, 8s, ...)

# --- MinIO (object storage) ---
S3_ENDPOINT_URL=http://minio:9000
S3_ACCESS_KEY=contract_check
S3_SECRET_KEY=contract_check
S3_BUCKET=contract-check-docs
S3_REGION=us-east-1
S3_SERVER_SIDE_ENCRYPTION=false   # true in prod
DOC_RETENTION_DAYS=7              # MinIO ILM expiry for raw docs (152-ФЗ lever)
TEXT_RETENTION_DAYS=30            # expiry for extracted .txt blobs

# --- Billing ---
REFUND_POLICY=all             # all | infra_only  (see docs/ARCHITECTURE.md §8)

# --- Observability (leave empty to disable) ---
SENTRY_DSN=
OTEL_EXPORTER_OTLP_ENDPOINT=  # e.g. http://otel-collector:4317
OTEL_SERVICE_NAME=contract-check

# --- LLM provider (abstract port; first realization = Ollama Cloud) ---
# For Ollama Cloud use https://ollama.com (not api.ollama.com). Models must be
# available on the chosen host — cloud models differ from local Ollama models.
LLM_PROVIDER=ollama_cloud
OLLAMA_HOST=https://ollama.com
OLLAMA_API_KEY=replace-me
OLLAMA_MODEL=qwen2.5:14b
OLLAMA_FALLBACK_MODEL=qwen2.5:7b
OLLAMA_TEMPERATURE=0.2
OLLAMA_NUM_PREDICT=3072
OLLAMA_TIMEOUT=120
OLLAMA_MAX_CONCURRENCY=3
CHUNK_SIZE_CHARS=10000

# --- API (FastAPI) ---
API_HOST=0.0.0.0
API_PORT=8000
API_METRICS_PORT=9100
B2B_DEFAULT_RATE_LIMIT_RPS=3  # per API key; mirrors Ollama Pro concurrency
CORS_ORIGINS=                 # comma-separated, future web SPA

# --- Auth (JWT + Telegram identity verification) ---
# Telegram bot token is also used by the API to verify Login Widget / Mini App signatures.
TELEGRAM_BOT_TOKEN=
JWT_SECRET=                  # HS256 secret for signing user JWTs; generate with `openssl rand -hex 32`
JWT_ALGORITHM=HS256
JWT_ACCESS_TTL_MINUTES=1440  # 24 hours default
JWT_REFRESH_TTL_DAYS=30      # refresh-token lifetime for webUI auth

# --- WebUI auth (email + password) ---
WEB_AUTH_ENABLED=true        # toggle /api/v1/auth/{register,login,...} routes
WEB_ADMIN_ENABLED=true       # toggle the /admin management UI (users role = 'admin')
ADMIN_REQUIRED_ROLE=admin    # users.role value required to enter /admin
ADMIN_DEFAULT_EMAIL=admin@contract-check.local
# Default admin password. Set once on first deploy; the user is auto-created with role=admin.
# Leave empty to disable default admin creation (create admins manually via DB or register).
ADMIN_DEFAULT_PASSWORD=changeme-strong-password
PASSWORD_RESET_TTL_MINUTES=60
PASSWORD_MIN_LENGTH=8
WEB_APP_BASE_URL=http://localhost:5173   # SPA base — used to build reset links

# --- SMTP (notification transport; empty host → dev logger) ---
SMTP_HOST=
SMTP_PORT=587
SMTP_USERNAME=
SMTP_PASSWORD=
SMTP_FROM=no-reply@contract-check.local
SMTP_USE_TLS=true

# --- Telegram bot (adapter, HTTP-only to api) ---
BOT_TOKEN=                    # same value as TELEGRAM_BOT_TOKEN (kept for the bot image)
BOT_SERVICE_TOKEN=            # bearer looked up against service_tokens.name="bot-prod"
API_URL=http://api:8000       # base URL of the api service (container DNS in compose)