.env_example

APP_NAME="Flask Authentication & Audit System"
SECRET_KEY=put-your-secret-key-here
# Bootstrap-only password used to create the first administrator. After that
# administrator chooses a private password, this value may be removed.
ADMIN_SECRET=adminpass
ADMIN_EMAIL=admin@yoursite.com
ACCESS_TOKEN_EXPIRE_MINUTES=30

# Fresh-database password-policy seed defaults. After EnvSettings is created,
# Admin -> Site Settings is authoritative at runtime. The default policy favors
# long passphrases and has no password-policy maximum length.
PASSWORD_POLICY_ENABLED=true
PASSWORD_MIN_LENGTH=20
PASSWORD_REQUIRE_UPPERCASE=false
PASSWORD_REQUIRE_LOWERCASE=false
PASSWORD_REQUIRE_NUMBER=false
PASSWORD_REQUIRE_SPECIAL=false

# .env.development
FLASK_ENV=development

# Fresh-database Site URL seed and startup Host/URL identity. Admin -> Site
# Settings may change the persisted value later; restart/reload the app after
# changing it so Flask can re-derive SERVER_NAME, PREFERRED_URL_SCHEME, and
# TRUSTED_HOSTS before serving requests. Domains and IP addresses are supported.
SITE_URL=http://127.0.0.1:5000

SQLALCHEMY_DATABASE_URI=sqlite:///./dev.db

# Optional local Docker Compose PostgreSQL overrides. These are used only when
# compose.postgres.yml is included. If omitted, the Compose overlay uses the
# development defaults shown below. Keep credentials URL-safe because the
# overlay composes them into SQLALCHEMY_DATABASE_URI.
# POSTGRES_DB=flaskaas
# POSTGRES_USER=dev-user
# POSTGRES_PASSWORD=test
# POSTGRES_PORT=5432
BACKEND_CORS_ORIGINS=["http://localhost","http://127.0.0.1"]
# Direct development: ignore forwarding headers.
PROXY_HOPS=0
TRUSTED_PROXIES=[]

# Example for one known reverse-proxy hop. Use only the immediate proxy
# addresses/networks you actually control, and have that proxy overwrite
# X-Forwarded-For / X-Real-IP rather than passing client values through.
# PROXY_HOPS=1
# TRUSTED_PROXIES=["172.17.0.0/16","127.0.0.1","::1"]

# Optional narrowly scoped origins required by downstream applications.
# CSP_CONNECT_SRC=["http://localhost:4566"]
# CSP_IMG_SRC=[]
# CSP_MEDIA_SRC=[]

CACHE_TYPE=SimpleCache
CACHE_DEFAULT_TIMEOUT=300

# Sliding inactivity timeout for authenticated browser sessions. Set to 0 to
# disable. Remember-cookie-restored sessions begin a new non-fresh inactivity
# window and still require reauthentication for sensitive operations.
SESSION_INACTIVITY_TIMEOUT_SECONDS=900

# Outbound email is enabled automatically on a clean install when MAIL_DEBUG
# is true or this environment SMTP configuration is complete. Site Settings
# retains the runtime Enable Outbound Email switch.
MAIL_DEBUG=false
MAIL_CONFIG_UI_ENABLED=false
# Required only when MAIL_CONFIG_UI_ENABLED=true and an SMTP password will be
# stored through Site Settings. Generate with:
# python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
MAIL_CONFIG_ENCRYPTION_KEY=

MAIL_SERVER=
MAIL_PORT=587
MAIL_USE_TLS=true
MAIL_USE_SSL=false
MAIL_USERNAME=
MAIL_PASSWORD=
MAIL_DEFAULT_SENDER=

# Example authenticated STARTTLS transport:
# MAIL_SERVER=smtp.yourdomain.com
# MAIL_PORT=587
# MAIL_USE_TLS=true
# MAIL_USE_SSL=false
# MAIL_USERNAME=you@yourdomain.com
# MAIL_PASSWORD=your_smtp_password
# MAIL_DEFAULT_SENDER=you@yourdomain.com

# .env.production
# FLASK_ENV="production"
# SITE_URL=https://example.com
# SQLALCHEMY_DATABASE_URI=postgresql+psycopg://postgres:password@localhost:5432/myapp
# BACKEND_CORS_ORIGINS=["http://domain.tld", "http://0.0.0.01"]

# CACHE_TYPE="RedisCache"
# CACHE_DEFAULT_TIMEOUT=300
# CACHE_REDIS_URL="redis://localhost:6379/0"