{# UhhCraft — env file template
   Rendered by Ansible's tasks/manage-secrets.yml on each deploy.

   Two variable namespaces (matching the platform convention, e.g. NetBox):
     * secrets.<name>   — credentials resolved from OpenBao by manage-secrets.yml
                          (keys come from deploy-uhhcraft.yml `_secret_definitions`).
     * uhhcraft_<name>  — NON-secret deployment config from inventory/group_vars
                          (supplied by the Phase 6 inventory; defaults below let
                          the template render in dev without it).

   Output: <deploy_dir>/.env (gitignored, read by compose env_file + the Go app).
   Variable VALUES feed env keys that must match internal/config/config.go exactly
   — the app boots via requireEnv() and aborts on a missing/misnamed key.
#}
# UhhCraft — production .env
# Generated by Ansible deploy-uhhcraft.yml on {{ ansible_date_time.iso8601 | default('<deploy-time>') }}
# Do NOT edit by hand. Re-run the playbook to refresh.

# ── App ──────────────────────────────────────────────────────────────────────
APP_ENV={{ uhhcraft_env | default('production') }}
APP_PORT=3000
APP_BASE_URL={{ uhhcraft_base_url | default(service_url | default('http://localhost:3000')) }}
SESSION_SECRET={{ secrets.session_secret }}
GIT_SHA={{ uhhcraft_git_sha | default('unknown') }}
UHHCRAFT_IMAGE={{ uhhcraft_image | default('ghcr.io/uhstray-io/uhhcraft:latest') }}

# ── Postgres ────────────────────────────────────────────────────────────────
POSTGRES_DB={{ uhhcraft_postgres_db | default('uhhcraft') }}
POSTGRES_USER={{ uhhcraft_postgres_user | default('uhhcraft') }}
POSTGRES_PASSWORD={{ secrets.postgres_password }}
{# Percent-encode the password embedded in the connection URL so reserved chars
   (@ : / # ? %) don't corrupt parsing. POSTGRES_PASSWORD above is read raw by
   the postgres container. #}
DATABASE_URL=postgres://{{ uhhcraft_postgres_user | default('uhhcraft') | urlencode }}:{{ secrets.postgres_password | urlencode }}@postgres:5432/{{ uhhcraft_postgres_db | default('uhhcraft') }}?sslmode=disable

# ── Redis ────────────────────────────────────────────────────────────────────
REDIS_PASSWORD={{ secrets.redis_password }}
REDIS_URL=redis://:{{ secrets.redis_password | urlencode }}@redis:6379/0

# ── MinIO (UhhCraft-owned; catalog assets only) ──────────────────────────────
# ROOT_* configure the minio container; ACCESS/SECRET_KEY are what the Go app
# reads (config.go). They default to the root creds unless a scoped key is set.
MINIO_ROOT_USER={{ secrets.minio_root_user }}
MINIO_ROOT_PASSWORD={{ secrets.minio_root_password }}
MINIO_ENDPOINT=minio:9000
MINIO_ACCESS_KEY={{ secrets.minio_access_key | default(secrets.minio_root_user) }}
MINIO_SECRET_KEY={{ secrets.minio_secret_key | default(secrets.minio_root_password) }}
MINIO_BUCKET={{ uhhcraft_minio_bucket | default('uhhcraft') }}
MINIO_USE_SSL=false

# ── AI sidecars (separate platform services) ─────────────────────────────────
AI_IMAGE_SERVICE_URL={{ uhhcraft_ai_image_url | default('http://inference-comfyui:8189') }}
AI_3D_SERVICE_URL={{ uhhcraft_ai_3d_url | default('http://inference-hunyuan3d:8001') }}

# ── Stripe ───────────────────────────────────────────────────────────────────
STRIPE_SECRET_KEY={{ secrets.stripe_secret_key }}
STRIPE_PUBLISHABLE_KEY={{ secrets.stripe_publishable_key }}
STRIPE_WEBHOOK_SECRET={{ secrets.stripe_webhook_secret }}
STRIPE_MODE={{ uhhcraft_stripe_mode | default('test') }}

# ── Email (Resend) ───────────────────────────────────────────────────────────
RESEND_API_KEY={{ secrets.resend_api_key }}
EMAIL_FROM={{ uhhcraft_email_from | default('orders@uhhcraft.uhstray.io') }}

# ── Discord notifications ────────────────────────────────────────────────────
# Two separate webhooks (orders vs ops) per config.go.
DISCORD_ORDERS_WEBHOOK_URL={{ secrets.discord_orders_webhook_url }}
DISCORD_OPS_WEBHOOK_URL={{ secrets.discord_ops_webhook_url }}

# ── USPS (shipping rates, v3 OAuth2) ─────────────────────────────────────────
# Names must match internal/config/config.go (USPS_CLIENT_ID / USPS_CLIENT_SECRET)
# and the OAuth2 client_credentials grant documented in config/usps.toml.
USPS_CLIENT_ID={{ secrets.usps_client_id }}
USPS_CLIENT_SECRET={{ secrets.usps_client_secret }}

# ── Fulfillment (Printify = sticker overflow, Hubs = 3D print overflow) ──────
# Optional. These keys are in _secret_definitions, so manage-secrets always
# resolves them (to '' when unset in OpenBao) — no Jinja default needed.
PRINTIFY_API_KEY={{ secrets.printify_api_key }}
PRINTIFY_SHOP_ID={{ secrets.printify_shop_id }}
HUBS_API_KEY={{ secrets.hubs_api_key }}

# ── Observability ────────────────────────────────────────────────────────────
LOG_LEVEL={{ uhhcraft_log_level | default('info') }}
LOG_FORMAT={{ uhhcraft_log_format | default('json') }}
