.env.example

# Docker Compose
COMPOSE_PROJECT_NAME=vinci-cms
APP_IMAGE=ghcr.io/sdutvinci/sdutvinci_web
APP_OPS_IMAGE=ghcr.io/sdutvinci/sdutvinci_web-ops
APP_IMAGE_TAG=replace-with-40-character-lowercase-commit-sha
# The stable gateway owns this host port; app-blue/app-green are internal only.
APP_BIND_ADDRESS=127.0.0.1
APP_PORT=3000

# Application
NODE_ENV=production
NUXT_PUBLIC_SITE_URL=https://replace-with-site-domain.example

# PostgreSQL. Recommended URL-safe password: `openssl rand -hex 32`.
# POSTGRES_PASSWORD is the raw password; DATABASE_URL uses the same password,
# percent-encoded only when it contains URL-special characters.
POSTGRES_DB=vinci_cms
POSTGRES_USER=vinci_cms
POSTGRES_PASSWORD=replace-with-a-long-random-database-password
DATABASE_URL=postgresql://vinci_cms:replace-with-a-url-encoded-password@postgres:5432/vinci_cms
# Integration tests only. The database name must contain a standalone "test" segment.
TEST_DATABASE_URL=postgresql://vinci_cms:replace-with-a-test-password@127.0.0.1:55432/vinci_cms_test
DATABASE_POOL_MAX=10
DATABASE_SSL=false

# CMS authentication (used from phase 1)
# Generate with: openssl rand -base64 48
CMS_AUTH_SECRET=replace-with-at-least-32-random-bytes
CMS_SESSION_COOKIE=vinci_cms_session
CMS_SESSION_TTL_HOURS=168
CMS_SECURE_COOKIES=true
CMS_LOGIN_FAILURE_LIMIT=5
CMS_LOGIN_FAILURE_WINDOW_MINUTES=15
CMS_LOGIN_LOCKOUT_MINUTES=15
CMS_LOGIN_IP_ATTEMPT_LIMIT=30
CMS_LOGIN_IP_WINDOW_MINUTES=5
CMS_MEDIA_UPLOAD_LIMIT=20
CMS_MEDIA_UPLOAD_WINDOW_MINUTES=1

# V2 phase 10 fixes public reads and publishing to PostgreSQL. Runtime source
# switches and the code-repository Git-first rollback are no longer supported.
CONTENT_PUBLISH_MODE=database

# V2 phase 6 one-way database snapshot export. Keep disabled until the
# read-only takeover report has been reviewed and its exact confirmation token
# has been approved. The worker accepts only this repository and main branch.
CONTENT_REPOSITORY_ID=SDUTVINCI/sdutvinci_content
CONTENT_EXPORT_MODE=disabled
CONTENT_EXPORT_REMOTE_URL=git@github.com:SDUTVINCI/sdutvinci_content.git
CONTENT_EXPORT_REMOTE=origin
CONTENT_EXPORT_BRANCH=main
CONTENT_EXPORT_WORKSPACE=/var/lib/vinci-cms/content-export
CONTENT_EXPORT_AUTHOR_NAME=Vinci Content Exporter
CONTENT_EXPORT_AUTHOR_EMAIL=content-export@localhost
CONTENT_EXPORT_SSH_KEY_FILE=/absolute/path/to/content_export_deploy_key
CONTENT_EXPORT_KNOWN_HOSTS_FILE=/absolute/path/to/content_export_known_hosts
CONTENT_EXPORT_BATCH_SIZE=50
CONTENT_EXPORT_POLL_SECONDS=60
CONTENT_EXPORT_LEASE_SECONDS=300
CONTENT_EXPORT_MAX_ATTEMPTS=5
CONTENT_EXPORT_RETRY_BASE_SECONDS=60
CONTENT_EXPORT_RETRY_MAX_SECONDS=3600

# V2 phase 7 daily reconciliation and isolated recovery. The normal app and
# reconciliation service keep recovery disabled; enable it only in the separate
# content-recovery profile for one reviewed operation.
CONTENT_RECONCILIATION_ROOT=/var/lib/vinci-cms/content-reconciliation
CONTENT_RECOVERY_MODE=disabled

# V2 phase 8 Pull Request import. Disabled is the safe deploy default. Enabling
# permits only the configured repository; imports create drafts/proposals only.
# The token is optional for public read-only Dry Run. The complete CMS workflow
# requires a repository-scoped fine-grained token with Contents and Pull requests
# both set to Read and write. Never log the token.
CONTENT_PR_IMPORT_MODE=disabled
CONTENT_PR_IMPORT_REPOSITORY_ID=SDUTVINCI/sdutvinci_content
CONTENT_PR_IMPORT_API_URL=https://api.github.com
CONTENT_PR_IMPORT_GITHUB_TOKEN=
CONTENT_PR_IMPORT_ROLE_CODES=content_importer
CONTENT_PR_IMPORT_MAX_FILE_BYTES=1048576
CONTENT_PR_IMPORT_MAX_FILES=500
CONTENT_PR_IMPORT_RETRY_ATTEMPTS=3
CONTENT_PR_IMPORT_TEST_MODE=false

# S3-compatible image storage (used from phase 6)
S3_ENDPOINT=https://replace-with-s3-endpoint
S3_REGION=replace-with-region
S3_BUCKET=replace-with-bucket
S3_ACCESS_KEY_ID=replace-with-access-key
S3_SECRET_ACCESS_KEY=replace-with-secret-key
S3_PUBLIC_BASE_URL=https://replace-with-public-image-domain
S3_FORCE_PATH_STYLE=false
S3_KEY_PREFIX=site-assets/images
S3_DOCTOR_MAX_OBJECTS=10000
CMS_IMAGE_MAX_BYTES=10485760
CMS_IMAGE_MAX_WIDTH=2560
CMS_IMAGE_MAX_HEIGHT=2560
CMS_IMAGE_WEBP_QUALITY=82

# Deployment safety. Must exactly match `git remote get-url origin`.
DEPLOY_GIT_REMOTE_URL=https://github.com/SDUTVINCI/sdutvinci_web.git
# Keep disabled until the first manual application deployment is accepted.
AUTO_DEPLOY_ENABLED=false
# Automatic deployments clean only rebuildable Docker cache and unreferenced old SHA images.
DEPLOY_CACHE_CLEANUP_ENABLED=true
DEPLOY_CACHE_KEEP_IMAGES=3
DEPLOY_CACHE_RETENTION_HOURS=168

# Backup location must be an absolute path outside this repository.
BACKUP_ROOT=/var/backups/vinci-cms
# A dump is retried in place before any successful-backup state or pruning gate
# is advanced. Keep the warning threshold at or above the critical threshold.
BACKUP_RETRY_ATTEMPTS=3
BACKUP_RETRY_DELAY_SECONDS=2
BACKUP_MIN_FREE_BYTES=1073741824
BACKUP_CRITICAL_FREE_BYTES=536870912
# Asia/Shanghai tiered retention. The latest successful backup, newest
# recoverability-verified backup, and all maintainer-locked backups are protected.
BACKUP_RETENTION_DAILY_DAYS=7
BACKUP_RETENTION_WEEKLY_WEEKS=4
BACKUP_RETENTION_MONTHLY_MONTHS=12
CONTENT_SNAPSHOT_RETENTION_DAYS=30
RECONCILIATION_REPORT_RETENTION_DAYS=90
RECONCILIATION_TEMP_RETENTION_DAYS=1

# Unified ./vinci operations. Paths must be absolute, outside this repository,
# owned by the current installation user, and never point at / or a Home root.
INSTANCE_EXPORT_ROOT=/var/backups/vinci-cms-instances
INSTANCE_RETENTION_DAYS=30
# Generated systemd services append only to this directory. The installer also
# installs a 30-day/100 MiB logrotate policy; secrets must never be logged.
VINCI_LOG_ROOT=/var/log/vinci-cms