.env.local.example

# ============================================================================
# eOrbitor Pulse - Local Deployment Environment Configuration
# ============================================================================
# This file contains all environment variables for local/on-premise deployment
# DO NOT expose this file to the internet - it contains sensitive information
# KEEP THIS FILE SECURE - Add to .gitignore
# ============================================================================

# ============================================================================
# DATABASE CONFIGURATION (PostgreSQL)
# ============================================================================
# Connection to internal PostgreSQL server only
# Format: postgresql://username:password@host:port/database

DATABASE_URL="postgresql://eorbitor:YourStrongDatabasePassword123!@localhost:5432/eorbitor_pulse"

# Database connection pool settings
DATABASE_POOL_MIN=2
DATABASE_POOL_MAX=10
DATABASE_CONNECTION_TIMEOUT=10000

# ============================================================================
# NODE.JS & APPLICATION CONFIGURATION
# ============================================================================

# Deployment environment
NODE_ENV="production"

# Application port (internal only - Nginx will proxy to this)
PORT=3000

# Server hostname (bind to all internal interfaces)
HOSTNAME="0.0.0.0"

# Application name and branding
APP_NAME="eOrbitor Pulse CRM"
APP_DISPLAY_NAME="eOrbitor Pulse"
APP_VERSION="1.0.0"

# Organization details
ORGANIZATION_NAME="Your Company Name"
ORGANIZATION_CODE="ORG001"

# Application URL (internal only)
APP_URL="http://eorbitor.internal"
APP_DOMAIN="eorbitor.internal"

# ============================================================================
# AUTHENTICATION & SECURITY
# ============================================================================

# JWT Configuration - Generate random strings with: openssl rand -base64 32
JWT_SECRET="CHANGE_ME_TO_RANDOM_STRING_openssl_rand_-base64_32"
JWT_ALGORITHM="HS256"
JWT_EXPIRATION="30d"
JWT_REFRESH_SECRET="CHANGE_ME_TO_RANDOM_STRING_openssl_rand_-base64_32"
JWT_REFRESH_EXPIRATION="90d"

# Session Configuration
SESSION_SECRET="CHANGE_ME_TO_RANDOM_STRING_openssl_rand_-base64_32"
SESSION_TIMEOUT=1800  # 30 minutes in seconds
SESSION_REFRESH_INTERVAL=300  # 5 minutes - refresh token every 5 min of activity

# Password Policy
PASSWORD_MIN_LENGTH=8
PASSWORD_REQUIRE_UPPERCASE=true
PASSWORD_REQUIRE_LOWERCASE=true
PASSWORD_REQUIRE_NUMBERS=true
PASSWORD_REQUIRE_SPECIAL_CHARS=true
PASSWORD_EXPIRATION_DAYS=90  # Force password change every 90 days
PASSWORD_HISTORY_COUNT=5  # Prevent reusing last 5 passwords

# Account Lockout Policy
MAX_LOGIN_ATTEMPTS=5
ACCOUNT_LOCKOUT_DURATION=900  # 15 minutes in seconds

# CORS Configuration - Internal Only
CORS_ORIGIN="http://eorbitor.internal,http://localhost:3000"
CORS_CREDENTIALS=true

# ============================================================================
# FILE UPLOAD CONFIGURATION (Local Storage)
# ============================================================================

# Local file storage directory (create this directory)
FILE_UPLOAD_DIR="/opt/eorbitor-pulse/uploads"

# Maximum file size: 50 MB
MAX_FILE_SIZE=52428800

# Allowed file types for uploads
ALLOWED_FILE_TYPES="pdf,doc,docx,xls,xlsx,ppt,pptx,jpg,jpeg,png,gif,zip"

# Document retention (days before auto-delete)
# -1 = never delete, 0 = immediate delete
DOCUMENT_RETENTION_DAYS=2555  # 7 years for compliance

# ============================================================================
# EMAIL CONFIGURATION (Internal SMTP Only)
# ============================================================================

# SMTP Server (Use your organization's internal mail server)
SMTP_HOST="smtp.company.local"
SMTP_PORT=587
SMTP_PROTOCOL="tls"  # Options: tls, ssl, none

# SMTP Credentials
SMTP_USER="crm-notifications@company.local"
SMTP_PASSWORD="YourEmailServicePassword123!"

# Email Sending Configuration
SMTP_FROM_EMAIL="crm-notifications@company.local"
SMTP_FROM_NAME="eOrbitor Pulse CRM"
SMTP_REPLY_TO="support@company.local"

# Email Queue Settings
EMAIL_QUEUE_ENABLED=true
EMAIL_BATCH_SIZE=10
EMAIL_BATCH_DELAY=1000  # milliseconds between batches

# Disable external email sending
EXTERNAL_EMAIL_ENABLED=false

# ============================================================================
# LOGGING CONFIGURATION
# ============================================================================

# Log level: debug, info, warn, error
LOG_LEVEL="info"

# Log directory
LOG_DIR="/var/log/eorbitor-pulse"

# Log files
LOG_FILE_ERROR="/var/log/eorbitor-pulse/error.log"
LOG_FILE_COMBINED="/var/log/eorbitor-pulse/combined.log"

# Log rotation (days)
LOG_ROTATION_DAYS=7

# Keep sensitive data out of logs
LOG_EXCLUDE_SENSITIVE_FIELDS=true

# ============================================================================
# DATABASE BACKUP CONFIGURATION
# ============================================================================

# Backup system
BACKUP_ENABLED=true

# Backup schedule (cron format: minute hour day month weekday)
# 0 2 * * * = Daily at 2:00 AM
BACKUP_SCHEDULE="0 2 * * *"

# Backup directory (must exist and be writable)
BACKUP_DIR="/backup/eorbitor-pulse"

# Backup retention (days)
BACKUP_RETENTION_DAYS=7

# Include activity logs in backup (set to false to reduce size)
BACKUP_INCLUDE_ACTIVITY_LOGS=true

# Database backup user (should have limited permissions)
BACKUP_DB_USER="backup_user"
BACKUP_DB_PASSWORD="BackupPassword123!"

# ============================================================================
# FEATURE FLAGS (Local Only - Disable Cloud Features)
# ============================================================================

# Cloud/External Features - DISABLED for local deployment
FEATURE_CLOUD_EXPORT=false
FEATURE_CLOUD_STORAGE=false
FEATURE_EXTERNAL_API_INTEGRATIONS=false
FEATURE_PUBLIC_API=false
FEATURE_OAUTH_PROVIDERS=false
FEATURE_SOCIAL_LOGIN=false
FEATURE_THIRD_PARTY_ANALYTICS=false

# Internal Features - ENABLED
FEATURE_OFFLINE_MODE=false  # Keep false for single-server setup
FEATURE_SOCKET_IO=true  # Real-time updates
FEATURE_ACTIVITY_LOG=true  # Audit trail
FEATURE_PDF_EXPORT=true  # Generate PDFs
FEATURE_EMAIL_NOTIFICATIONS=true
FEATURE_CALENDAR_INTEGRATION=false  # No external calendar sync

# ============================================================================
# SOCKET.IO CONFIGURATION (Real-time Updates)
# ============================================================================

# Enable WebSocket for real-time features
SOCKET_IO_ENABLED=true
SOCKET_IO_NAMESPACE="/socket.io"

# Socket.io connection settings
SOCKET_IO_CORS_ORIGIN="http://eorbitor.internal"
SOCKET_IO_RECONNECTION_DELAY=1000
SOCKET_IO_RECONNECTION_DELAY_MAX=5000
SOCKET_IO_RECONNECTION_ATTEMPTS=5

# ============================================================================
# TIMEZONE & LOCALIZATION
# ============================================================================

# Application timezone
TIMEZONE="Asia/Kolkata"  # Change to your timezone
LOCALE="en-IN"  # English - India

# Date/Time Format
DATE_FORMAT="DD/MM/YYYY"
TIME_FORMAT="HH:mm:ss"
CURRENCY_SYMBOL="₹"  # Indian Rupee

# ============================================================================
# BUSINESS CONFIGURATION
# ============================================================================

# Tax Configuration (GST)
DEFAULT_TAX_RATE=18  # 18% GST
TAX_ROUNDING_MODE="round"  # round, ceil, floor

# Financial Settings
FISCAL_YEAR_START="04-01"  # April 1st (Indian Fiscal Year)
FISCAL_YEAR_END="03-31"    # March 31st

# Quotation Expiry (days)
QUOTATION_DEFAULT_EXPIRY_DAYS=30

# Order Configuration
ORDER_AUTO_INVOICE_ON_DELIVERY=false
PAYMENT_TERMS_DEFAULT="NET30"  # Due date: 30 days from invoice

# ============================================================================
# PAGINATION & PERFORMANCE
# ============================================================================

# Default pagination
PAGINATION_DEFAULT_SIZE=20
PAGINATION_MAX_SIZE=100

# Search
SEARCH_MIN_CHARACTERS=2
SEARCH_MAX_RESULTS=1000

# Database Query Timeout (milliseconds)
QUERY_TIMEOUT=30000

# ============================================================================
# AUDIT & COMPLIANCE
# ============================================================================

# Activity logging
ACTIVITY_LOG_ENABLED=true
ACTIVITY_LOG_RETENTION_DAYS=2555  # 7 years

# Fields to audit (CSV)
AUDIT_TRACKED_FIELDS="email,phone,gst,price,payment_status,order_status"

# User action logging
LOG_USER_ACTIONS=true
LOG_SUCCESSFUL_LOGINS=true
LOG_FAILED_LOGINS=true

# ============================================================================
# ADVANCED SETTINGS (Normally Don't Change)
# ============================================================================

# Express.js settings
EXPRESS_TRUST_PROXY=true
EXPRESS_COMPRESSION_ENABLED=true

# Next.js optimization
NEXT_PUBLIC_API_URL="http://eorbitor.internal/api"

# Strict mode (production)
STRICT_MODE=true

# Rate limiting
RATE_LIMIT_ENABLED=true
RATE_LIMIT_WINDOW_MS=900000  # 15 minutes
RATE_LIMIT_MAX_REQUESTS=100

# ============================================================================
# DEVELOPMENT/DEBUG (Set to false in production)
# ============================================================================

# Debug mode
DEBUG=false

# Show detailed error messages
DETAILED_ERRORS=false

# Pretty-print logs
PRETTY_LOGS=false

# ============================================================================
# IMPORTANT NOTES
# ============================================================================
#
# 1. SECURITY:
#    - Generate strong random values for JWT_SECRET and SESSION_SECRET
#    - Use openssl rand -base64 32 to generate random strings
#    - Never commit this file to git (add to .gitignore)
#    - Restrict file permissions: chmod 600 .env.local
#
# 2. DATABASE PASSWORD:
#    - Use a strong password (min 12 characters, mixed case, numbers, symbols)
#    - The backup_user should have SELECT-only permissions
#    - Change passwords regularly
#
# 3. EMAIL CONFIGURATION:
#    - Use your organization's internal SMTP server
#    - DO NOT use external services (Gmail, Office 365, etc.)
#    - Create a dedicated mailbox for CRM notifications
#
# 4. BACKUPS:
#    - Ensure /backup/eorbitor-pulse directory exists
#    - Verify backups are running daily
#    - Test restoration monthly
#    - Store backups on a separate drive/server if possible
#
# 5. NETWORK SECURITY:
#    - This application is for internal use ONLY
#    - Do not expose to the internet
#    - Use firewall rules to restrict access to internal IPs
#    - No external DNS or port forwarding
#
# 6. LOGGING:
#    - Keep logs for audit and troubleshooting
#    - Configure log rotation to prevent disk full
#    - Review logs regularly for suspicious activity
#
# 7. MONITORING:
#    - Monitor disk space, CPU, and memory regularly
#    - Check application logs daily
#    - Set up alerts for critical errors
#
# ============================================================================