# Copy this file to .env and adjust values before running `docker compose up`.

# --- Postgres ---
# IMPORTANT, and easy to get wrong: Postgres only applies this password when
# it FIRST creates its data directory. Change it later and the running
# database keeps the old one — the value here and the value in the database
# drift apart, and the backend starts failing to connect with a password
# authentication error that looks like it came out of nowhere. So set it
# before the first `docker compose up`. Changing it afterwards means either
# ALTER USER inside the running database, or deleting the aurum_pgdata volume
# (which deletes all your data — export a backup from Settings first).
#
# The database is not published to your host machine (no ports mapping for the
# db service), so it's only reachable from inside the container network.
AURUM_POSTGRES_USER=aurum
AURUM_POSTGRES_PASSWORD=change-me
AURUM_POSTGRES_DB=aurum
AURUM_POSTGRES_HOST=db
AURUM_POSTGRES_PORT=5432

# --- Backend ---
# Comma-separated list of browser origins allowed to call the API. Leave it
# empty unless you serve the frontend from a different origin than the API:
# docker compose serves both from the same nginx, and the Vite dev server
# proxies /api, so neither needs this. "*" is honoured but then credentials
# are never granted, because "*" plus credentials lets any site you visit
# read this instance.
AURUM_CORS_ORIGINS=
AURUM_DEFAULT_CURRENCY=USD

# --- Crypto tab (live prices via CoinGecko) ---
# Free Demo API key, no card required: coingecko.com/en/api/pricing. Leave
# blank and the Crypto tab's price sync just 400s with a message telling
# you to set this — nothing else in the app is affected.
AURUM_COINGECKO_API_KEY=

# Swagger UI / ReDoc / openapi.json at /api/docs. Left on: the REST API is a
# documented feature (see DOCS.md), and when basic auth is configured these
# sit behind it like every other /api/ route. Set it to false on an instance
# that's reachable from the internet without basic auth — an open
# openapi.json is a complete machine-readable map of every endpoint.
AURUM_ENABLE_DOCS=true

# --- Basic auth (STRONGLY recommended if this instance is reachable from
# anywhere other than your own machine) ---
# Aurum has no login system of its own — it's built for one person
# self-hosting their own private instance, not a multi-tenant service.
# Leave both blank and there is NO password on this app at all: anyone who
# can reach it can read, edit, and delete every transaction, account, and
# asset. Set both to put an HTTP Basic Auth prompt in front of the whole
# app (UI + API). See frontend/docker-entrypoint.d/20-basic-auth.sh.
AURUM_BASIC_AUTH_USER=
AURUM_BASIC_AUTH_PASSWORD=

# --- Ports exposed on your host machine ---
AURUM_WEB_PORT=3000

# Which host interface Aurum listens on. The default, 127.0.0.1, means "this
# machine only" — nothing else on your network can reach it. Change it to
# 0.0.0.0 to open it up (phone on the same Wi-Fi, another PC, a reverse
# proxy), but set the basic auth variables above first: without them the app
# has no password, and this is the line that decides who can knock.
AURUM_BIND_ADDRESS=127.0.0.1