# Copy this file to `.env` (same folder as docker-compose.yml) and fill in values.
#
# Used by docker-compose.yml
#
# Database. deploy/deploy.sh REQUIRES DATABASE_PROVIDER to be set explicitly and
# refuses to deploy without it — it selects which backup to take, and guessing it
# wrong means backing up the wrong database. Use `mariadb` (or `mysql`) for a
# server deployment, `sqlite` for a single-file local one.
DATABASE_PROVIDER=sqlite
# Required when DATABASE_PROVIDER is mariadb/mysql. Ignored for sqlite, which
# stores its file in the jobtracker_data volume.
# The host resolves from INSIDE the backend container: 127.0.0.1 means the
# container, not the Docker host.
JOBTRACKER_CONNECTION_STRING=

AUTH_JWT_KEY=CHANGE_ME_LONG_RANDOM_SECRET
AUTH_ADMIN_EMAIL=admin@example.com
AUTH_ADMIN_PASSWORD=CHANGE_ME_STRONG_PASSWORD
# Public signup remains closed until explicitly enabled. Configure both Turnstile keys first.
AUTH_ALLOW_REGISTRATION=false
# Require local accounts to confirm ownership of their email address before signing in.
AUTH_REQUIRE_EMAIL_VERIFICATION=true
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=
# Optional hosted Stripe Checkout. Configure all three values and the customer portal before enabling billing.
STRIPE_SECRET_KEY=
STRIPE_PRICE_PREMIUM=
STRIPE_WEBHOOK_SECRET=
AUTH_GOOGLE_CLIENT_ID=CHANGE_ME_GOOGLE_CLIENT_ID
# Optional: enables the "Continue with Microsoft" sign-in tab (separate from the
# MICROSOFT_CLIENT_ID below, which is for Outlook mail linking, not sign-in).
AUTH_MICROSOFT_CLIENT_ID=
GOOGLE_GMAIL_CLIENT_SECRET=CHANGE_ME_GOOGLE_OAUTH_CLIENT_SECRET
# Optional. If omitted, the backend uses https://<your-domain>/api/gmail/oauth/callback
GOOGLE_GMAIL_REDIRECT_URI=
MICROSOFT_CLIENT_ID=CHANGE_ME_MICROSOFT_CLIENT_ID
MICROSOFT_CLIENT_SECRET=CHANGE_ME_MICROSOFT_OAUTH_CLIENT_SECRET
# Optional. Defaults to "common" (personal + work/school accounts).
MICROSOFT_TENANT_ID=
# Optional. If omitted, the backend uses https://<your-domain>/api/microsoft-graph/oauth/callback
MICROSOFT_REDIRECT_URI=
AI_SERVICE_BASE_URL=http://ai-service:8001
# REQUIRED. Shared secret the backend sends to ai-service on every call except /health.
# The stack refuses to start without it. Generate with: openssl rand -hex 32
AI_SERVICE_TOKEN=
# Optional: enables hybrid CV block classification in the local AI service.
OLLAMA_BASE_URL=http://ollama:11434
OLLAMA_MODEL=qwen2.5:7b

# AI provider for the heavy /cv/* calls: ollama (default, local) | gemini | groq.
# /summarize always stays local (distilbart). To offload a weak production GPU,
# set AI_PROVIDER=gemini (or groq) and provide the matching key below.
# Keys are read from the environment only — never commit real keys.
AI_PROVIDER=ollama
GEMINI_API_KEY=
GEMINI_MODEL=gemini-2.0-flash
GROQ_API_KEY=
GROQ_MODEL=llama-3.3-70b-versatile

# Optional: only needed if you want the UI to call a non-default API base URL.
# In production the UI defaults to `/api`.
NEXT_PUBLIC_API_BASE_URL=

# Used by docker-compose.yml (email / password resets / notifications)
APP_PUBLIC_BASE_URL=https://jobs.cesnimda.uk
APP_VERSION=
APP_COMMIT_SHA=
APP_BUILD_STAMP=
EMAIL_ENABLED=false
EMAIL_SMTP_HOST=smtp.gmail.com
EMAIL_SMTP_PORT=587
EMAIL_SMTP_USER=CHANGE_ME_GMAIL_ADDRESS
EMAIL_SMTP_PASSWORD=CHANGE_ME_GOOGLE_APP_PASSWORD
EMAIL_FROM=CHANGE_ME_GMAIL_ADDRESS
EMAIL_FROM_NAME=Jobbjakt
EMAIL_FOLLOWUPREMINDERS_ENABLED=true
EMAIL_FOLLOWUPREMINDERS_UPCOMINGDAYS=2

EMAIL_SMTP_ENABLE_SSL=true
EMAIL_SMTP_TIMEOUT_MS=15000