.env.example

# NETWORKING CONFIGURATION
# For local development (app runs on host):
#   DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5433/postgres
#   S3_ENDPOINT=localhost:9000
#
# For Docker development (app runs in container):
#   DATABASE_URL=postgresql+asyncpg://postgres:postgres@postgres:5432/postgres
#   S3_ENDPOINT=minio:9000
#
# The values below are for local development. Docker setup uses docker-compose.dev.yml environment overrides.

# Database Configuration
DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5433/postgres
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_DB=postgres
POSTGRES_SERVER=localhost
POSTGRES_PORT=5433

# Host Port Overrides (change if you have port conflicts)
# MINIO_API_PORT=9000
# MINIO_CONSOLE_PORT=9001
# PGADMIN_PORT=8080

# S3/MinIO Configuration
S3_ENDPOINT=localhost:9000
S3_ACCESS_KEY=minioadmin
S3_SECRET_KEY=minioadminpassword
S3_BUCKET=data-storage
S3_USE_SSL=false

# Application Configuration
APP_NAME="Data Management API"
DEBUG=false
PORT=8000
FAST_TEST_MODE=false
SKIP_HEADER_CHECK=false
CHECK_MOCK_MEMBERSHIP=true
MOCK_USER_EMAIL=test@example.com
MOCK_USER_GROUPS_JSON='["admin-group", "data-scientists", "project-alpha-group", "testgroup"]'

# Deployment Environment: development | staging | production
# When set to "production", the app refuses to start with DEBUG=true,
# SKIP_HEADER_CHECK=true, VISTA_AUTH_BACKEND=demo, or a missing
# PROXY_SHARED_SECRET.
ENV=development

# Group Authorization Backend (REQUIRED -- fail-closed by default)
#   demo   -- hardcoded example mapping in core.group_auth. Development
#             and automated tests only; refused when ENV=production.
#   custom -- integrator has replaced core.group_auth._check_group_membership
#             with a real auth system (LDAP, OIDC, etc.). Startup self-test
#             verifies the stub was replaced and denies demo emails.
# If unset or set to any other value, the app refuses to start.
VISTA_AUTH_BACKEND=demo

# Security Configuration
SECURITY_NOSNIFF_ENABLED=true
SECURITY_XFO_ENABLED=true
SECURITY_XFO_VALUE=SAMEORIGIN
SECURITY_REFERRER_POLICY_ENABLED=true
SECURITY_REFERRER_POLICY_VALUE=no-referrer
SECURITY_CSP_ENABLED=true

# Cache Configuration
CACHE_SIZE_MB=1000

# Frontend Configuration
FRONTEND_BUILD_PATH=frontend/build