# Copy to .env beside docker-compose.yml. Never commit real secret values.
# Full descriptions: docs/configuration/environment-variables.md

# =============================================================================
# DATABASE
# =============================================================================
DATABASE_PROVIDER=sqlite
# Required for mariadb/mysql; ignored for sqlite.
JOBTRACKER_CONNECTION_STRING=

# =============================================================================
# AUTHENTICATION, IDENTITY, BILLING
# =============================================================================
AUTH_JWT_KEY=
AUTH_ADMIN_EMAIL=admin@example.com
AUTH_ADMIN_PASSWORD=
AUTH_ALLOW_REGISTRATION=false
AUTH_REQUIRE_EMAIL_VERIFICATION=true
ACCOUNT_DELETION_ENABLED=false
TURNSTILE_SITE_KEY=
TURNSTILE_SECRET_KEY=
STRIPE_SECRET_KEY=
STRIPE_PRICE_PREMIUM=
STRIPE_WEBHOOK_SECRET=
AUTH_GOOGLE_CLIENT_ID=
AUTH_MICROSOFT_CLIENT_ID=
AUTH_MICROSOFT_TENANT=common

# =============================================================================
# MAIL PROVIDER CONNECTIONS
# =============================================================================
GOOGLE_GMAIL_CLIENT_SECRET=
MICROSOFT_CLIENT_ID=
MICROSOFT_CLIENT_SECRET=
MICROSOFT_TENANT_ID=

# =============================================================================
# AI SERVICE AND PROVIDERS
# =============================================================================
AI_SERVICE_BASE_URL=http://ai-service:8001
# Required for protected backend -> AI service calls.
AI_SERVICE_TOKEN=
OLLAMA_BASE_URL=http://ollama:11434
OLLAMA_MODEL=qwen2.5:7b
AI_PROVIDER=ollama
EXTERNAL_AI_ENABLED=false
AI_ROUTING_MODE=local_first
EXTERNAL_AI_ALLOWED_TASKS=cv-normalize,cv-classify,cv-rewrite
EXTERNAL_AI_MAX_PROMPT_CHARS=24000
LOCAL_AI_CIRCUIT_FAILURE_THRESHOLD=3
LOCAL_AI_CIRCUIT_OPEN_SECONDS=30
PARSER_TIMEOUT_SECONDS=25
PARSER_CPU_SECONDS=20
PARSER_MEMORY_MIB=512
PARSER_STALE_WORK_SECONDS=3600
GEMINI_API_KEY=
GEMINI_MODEL=gemini-2.0-flash
GROQ_API_KEY=
GROQ_MODEL=llama-3.3-70b-versatile
WORKER_AI_OPERATIONS_ENABLED=false
AI_QUEUE_WORKER_CONCURRENCY=1
AI_QUEUE_GLOBAL_CAPACITY=100
AI_QUEUE_PER_USER_CAPACITY=10
AI_QUEUE_DEADLINE_MINUTES=15
AI_QUEUE_OPERATION_TIMEOUT_SECONDS=300

# =============================================================================
# FRONTEND AND PUBLIC APPLICATION
# =============================================================================
# Leave empty in production so nginx proxies same-origin /api requests.
NEXT_PUBLIC_API_BASE_URL=
APP_PUBLIC_BASE_URL=https://jobs.cesnimda.uk
APP_VERSION=
APP_COMMIT_SHA=
APP_BUILD_STAMP=

# =============================================================================
# INGRESS AND MAINTENANCE
# =============================================================================
WEB_PROXY_SUBNET=172.31.250.0/29
# Space-separated trusted reverse-proxy peer CIDRs; required in production.
INGRESS_PROXY_CIDRS=
MAINTENANCE_GITEA_BASE_URL=https://git.cesnimda.uk
MAINTENANCE_GITEA_OWNER=cesnimda
MAINTENANCE_GITEA_REPOSITORY=jobtrackingapp
MAINTENANCE_GITEA_TOKEN=

# =============================================================================
# BACKUPS
# =============================================================================
BACKUP_TIMEZONE=Europe/Oslo
BACKUP_DAILY_RETENTION_DAYS=30
BACKUP_MONTHLY_RETENTION_COUNT=12
# Optional encrypted rclone destination, e.g. gdrive-crypt:jobtracker.
BACKUP_RCLONE_REMOTE=

# =============================================================================
# SMTP AND EMAIL WORKERS
# =============================================================================
EMAIL_ENABLED=false
EMAIL_SMTP_HOST=smtp.gmail.com
EMAIL_SMTP_PORT=587
EMAIL_SMTP_USER=
EMAIL_SMTP_PASSWORD=
EMAIL_FROM=
EMAIL_FROM_NAME=Jobbjakt
EMAIL_FOLLOWUPREMINDERS_ENABLED=false
EMAIL_FOLLOWUPREMINDERS_UPCOMINGDAYS=2
EMAIL_SMTP_ENABLE_SSL=true
EMAIL_SMTP_TIMEOUT_MS=15000

# =============================================================================
# APPLICATION WORKERS AND DISCOVERY
# =============================================================================
WORKER_RULES_ENABLED=false
WORKER_FOLLOWUP_REMINDERS_ENABLED=false
WORKER_SAVED_SEARCH_ALERTS_ENABLED=true
SAVED_SEARCH_INTERVAL_HOURS=6
WORKER_DAILY_EXPORT_ENABLED=false
WORKER_JOB_ENRICHMENT_ENABLED=false