# Copy to .env (cmd/api autoloads it via godotenv when run from backend/).
# Every value below is the default from internal/config — uncomment to override.

# HTTP listen address.
#API_ADDR=:8080

# Database: a local SQLite file by default (pure-Go driver; WAL +
# busy_timeout are auto-applied unless the DSN has its own _pragma params).
# For Postgres instead: `make db-up`, then use the DSN below.
#DATABASE_URL=sqlite:dev.db
#DATABASE_URL=postgres://fullstack:fullstack@localhost:5432/fullstack?sslmode=disable

# Comma-separated CORS origins allowed to call the API from a browser.
# "*" allows every origin.
#CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173

# debug | info | warn | error
#LOG_LEVEL=info

# json | text
#LOG_FORMAT=json

# Print every SQL query bun runs (bundebug).
#DB_DEBUG=false

# --- OIDC auth (issuer: https://users.k6n.net) ---
# Auth is ENABLED when OIDC_CLIENT_ID is set: /api/auth/login starts the
# authorization-code + PKCE flow, /api/v1/* then requires the session cookie.
# Leave both empty to run standalone (no /api/auth routes, /api/v1 open).
# The registered redirect URIs for this client cover
# https://*.preview.k6n.net/api/auth/callback and localhost on any port
# (loopback exception), so dev and preview hosts both work.
#OIDC_ISSUER=https://users.k6n.net
#OIDC_CLIENT_ID=fullstack-template
# Secret from the issuer's client registry — NOT safe to commit (keep it in .env).
#OIDC_CLIENT_SECRET=

# Secret used to sign session cookies. Unset = random per boot (all sessions
# are dropped on restart). Set a stable value in production.
#AUTH_SESSION_SECRET=

# Session lifetime as a Go duration.
#AUTH_SESSION_TTL=168h