# MARK — PRODUCTION (./scripts/deploy.sh prod up)
# Same build as staging; switching is an env swap. Do NOT copy staging values:
# fresh database, fresh JWT/encryption keys, live Meta app, real WABA.
# Keep comments on their own lines: Docker env files do not strip inline comments.
#
# Switch checklist:
#   [ ] Meta app switched to Live mode; Advanced Access approved (App Review)
#   [ ] Business verification complete; production WABA + real phone number registered
#   [ ] Webhook URL pointed at https://<api domain>/whatsapp/webhook with the prod verify token
#   [ ] New database (staging data holds sandbox tokens encrypted with the staging key)
#   [ ] Stripe live keys, real SMTP, Sentry DSN, S3 bucket
#   [ ] HTTPS on WEB_URL and META_REDIRECT_URI (enforced at boot)
#   [ ] DNS for WEB_DOMAIN / API_DOMAIN pointing at the server; certificates issued (deploy.sh prod certs)

NODE_ENV=production

# ---- Deploy target --------------------------------------------------------------
# Leave empty to deploy to this machine's Docker, or ssh://user@host for a server.
DEPLOY_DOCKER_HOST=
# Set to false to use managed Postgres/Redis/S3 (then set DATABASE_URL, REDIS_HOST, S3_* accordingly).
USE_BUNDLED_INFRA=true

# ---- Edge (nginx) -----------------------------------------------------------------
WEB_DOMAIN=mark.ae
API_DOMAIN=api.mark.ae
# Bootstrap with http, run "deploy.sh prod certs", then set tls and redeploy.
NGINX_MODE=tls
LETSENCRYPT_EMAIL=
HTTP_PORT=80
HTTPS_PORT=443

# ---- Host ports (127.0.0.1 only; nginx is the public entry) --------------------------
WEB_HOST_PORT=3002
API_HOST_PORT=3030
POSTGRES_HOST_PORT=5433
REDIS_HOST_PORT=6380

# ---- Postgres (bundled). DATABASE_URL must use the same password ----------------------
POSTGRES_USER=mark
POSTGRES_PASSWORD=
POSTGRES_DB=mark
DATABASE_URL=postgresql://mark:REPLACE_WITH_POSTGRES_PASSWORD@postgres:5432/mark?schema=public

# ---- Core -------------------------------------------------------------------------
API_PORT=3030
REDIS_HOST=redis
REDIS_PORT=6379
JWT_SECRET=
TOKEN_ENCRYPTION_KEY=
ADMIN_API_KEY=

# ---- URLs (the web image bakes NEXT_PUBLIC_API_URL in at build time) ---------------------
WEB_URL=https://mark.ae
NEXT_PUBLIC_API_URL=https://api.mark.ae
CORS_ORIGINS=https://www.mark.ae

# ---- Meta (live app) --------------------------------------------------------------------
META_APP_ID=
META_APP_SECRET=
META_LOGIN_CONFIG_ID=
META_REDIRECT_URI=https://api.mark.ae/meta/callback
GRAPH_API_VERSION=v21.0

# ---- WhatsApp ----------------------------------------------------------------------------
WHATSAPP_APP_SECRET=
WHATSAPP_VERIFY_TOKEN=
SKIP_SIGNATURE_VERIFY=false

# ---- AI -----------------------------------------------------------------------------------
OPENAI_API_KEY=
AI_STUB_MODE=false

# ---- Storage / mail / billing -------------------------------------------------------------
S3_ENDPOINT=http://localhost:9000
S3_BUCKET=mark-media
S3_ACCESS_KEY=
S3_SECRET_KEY=
SMTP_HOST=
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=noreply@mark.ae
# sk_live_...
STRIPE_SECRET_KEY=
STRIPE_WEBHOOK_SECRET=
SENTRY_DSN=