# Django
# За Traefik: acore.settings.production, DEBUG=False, gunicorn на :8000 внутри LXC.
DJANGO_SETTINGS_MODULE=acore.settings.local
DEBUG=True
SECRET_KEY=change-me-in-production
ALLOWED_HOSTS=10.10.31.3,localhost,127.0.0.1
# Публичное имя через Traefik (Host rule) — добавьте к ALLOWED_HOSTS:
# ALLOWED_HOSTS=portal.example.local,10.10.31.3
# PORTAL_BASE_URL=https://portal.example.local
# CSRF_TRUSTED_ORIGINS=https://portal.example.local
DATABASE_URL=postgres://acore:CHANGE_ME@10.10.31.2:5432/acore

# Fernet field encryption for ConnectorConfig / bot tokens / Carbonio passwords.
# MUST be set in production (acore.settings.production refuses empty value).
# Keep equal to the key used when secrets were encrypted, or re-encrypt after rotation.
# Prefer a value DISTINCT from SECRET_KEY once you are ready to rotate.
FIELD_ENCRYPTION_KEY=

# Mattermost integrations (fail-closed when empty)
MATTERMOST_SLASH_COMMAND_TOKEN=
# Interactive button actions; defaults to slash token if unset
MATTERMOST_INTERACTIVE_TOKEN=
PORTAL_BASE_URL=http://localhost:8000

# Карты Leaflet: CARTO basemaps требуют бесплатный API key (иначе — OpenStreetMap).
# https://carto.com/basemaps/apikey/
# CARTO_BASEMAPS_API_KEY=

# ACORE → PNMS identity sync (must match PNMS ACORE_SYNC_TOKEN).
# В production DEBUG=False требует https:// — в payload уходит password_hash (PBKDF2).
# PNMS_SYNC_ENABLED=1
# PNMS_BASE_URL=https://pnms.example
# PNMS_ACORE_TOKEN=

# ACORE → MSORTER (сотрудники в группе «Почта»). Токен = MSORTER ACORE_SYNC_TOKEN.
# В production DEBUG=False требует https://.
# MSORTER_SYNC_ENABLED=1
# MSORTER_BASE_URL=https://msorter.example
# MSORTER_ACORE_TOKEN=

# ACORE → PVMS (посещаемость). Токен = PVMS ACORE_SYNC_TOKEN.
# PVMS_ATTENDANCE_SOT=1 после dump: портал и /api/attendance/register/ идут в PVMS.
# PVMS_SYNC_ENABLED=1
# PVMS_BASE_URL=https://pvms.example
# PVMS_ACORE_TOKEN=
# PVMS_REPORT_TOKEN=   # опционально отдельный для /api/reports/; иначе = ACORE_TOKEN
# PVMS_ATTENDANCE_SOT=0

# Redis cache for production (login throttle across workers). Separate DB from Celery /0.
# Production требует пароль в URL (requirepass). Временно: REDIS_ALLOW_UNAUTHENTICATED=1.
# CACHE_URL=redis://:CHANGE_ME@127.0.0.1:6379/1
# CELERY_BROKER_URL=redis://:CHANGE_ME@127.0.0.1:6379/0
# CELERY_RESULT_BACKEND=redis://:CHANGE_ME@127.0.0.1:6379/0
# REDIS_ALLOW_UNAUTHENTICATED=1