.env.example

# KSeF Hub — Environment Variables
# Copy to .env and fill in your values:  cp .env.example .env

# --- Google OAuth (admin UI login) ---
# Create at: https://console.cloud.google.com/apis/credentials
GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your-client-secret

# --- KSeF API ---
# Test: https://api-test.ksef.mf.gov.pl
# Production: https://api.ksef.mf.gov.pl
KSEF_API_URL=https://api-test.ksef.mf.gov.pl

# --- PDF renderer sidecar (FA(3) XML → PDF/HTML) ---
PDF_RENDERER_URL=http://localhost:3001

# --- Database (optional in dev — overrides config/dev.exs localhost defaults) ---
# For Supabase, use the session pooler (port 5432, NOT pgbouncer 6543):
# DATABASE_URL=ecto://postgres.PROJECT_REF:PASSWORD@aws-0-REGION.pooler.supabase.com:5432/postgres

# --- Credential encryption key (certificate storage) ---
# Base64-encoded 32-byte AES-256 key for encrypting certificates at rest.
# Falls back to SHA256(SECRET_KEY_BASE) if not set.
# Generate a new key:  elixir -e ':crypto.strong_rand_bytes(32) |> Base.encode64() |> IO.puts()'
# Migrate existing:    elixir -e ':crypto.hash(:sha256, "<SECRET_KEY_BASE>") |> Base.encode64() |> IO.puts()'
# CREDENTIAL_ENCRYPTION_KEY=base64-encoded-32-byte-key

# --- Invoice extractor sidecar (PDF → structured JSON) ---
INVOICE_EXTRACTOR_URL=http://localhost:3002
INVOICE_EXTRACTOR_API_TOKEN=dev-token-change-in-prod

# --- Anthropic API key (used by invoice-extractor sidecar AND Elixir app for emoji generation) ---
ANTHROPIC_API_KEY=sk-ant-your-key-here

# --- Inbound email (Mailgun) ---
# Webhook signing key from Mailgun dashboard (Settings > Webhooks > Signing Key)
# MAILGUN_SIGNING_KEY=key-abc123...
# API key for sending emails (Settings > API Keys)
# MAILGUN_API_KEY=key-abc123...
# Mailgun sending domain (e.g., mg.example.com)
# MAILGUN_DOMAIN=mg.example.com
# Domain for inbound email addresses (e.g., inv-{token}@inbound.ksef-hub.com)
# INBOUND_EMAIL_DOMAIN=inbound.ksef-hub.com
# Allowed sender domain and CC email are now per-company settings in the database.

# --- Sync interval ---
# KSeF invoice sync cron interval in minutes (default: 60, must be a divisor of 60)
# SYNC_INTERVAL_MINUTES=60

# --- Production only ---
# SECRET_KEY_BASE=generate-with-mix-phx-gen-secret
# PHX_HOST=your-domain.com
# PORT=4000
# PHX_SERVER=true
# POOL_SIZE=10
# ECTO_IPV6=false