# Fuel Wizard environment — copy to `.env` at the repo root and adjust.
# Development: the back end auto-loads this file (ASPNETCORE_ENVIRONMENT=Development).
# Production: the root compose.yaml interpolates it; containers never see this file itself.
# Frontend dev-only overrides: frontend/.env.development.local (never put secrets in tracked files).

# --- Database ---
# Development only (back end on the host, DB from backend/Database/Deployment/compose.yaml):
TIMESCALE_DB_CONNECTION=Host=localhost;Port=5432;Database=postgres;Username=postgres;Password=password
# Production: compose creates the DB and assembles the back end's TIMESCALE_DB_CONNECTION from these:
DB_USER=postgres
DB_PASSWORD=change-me-to-something-secure

# --- NSW OneGov fuel API (REQUIRED — the back end fails to start without all three) ---
# These are the public sandbox values — sign up and replace them for production:
NSW_FUEL_API_KEY=1MYSRAx5yvqHUZc6VGtxix6oMA2qgfRT
NSW_FUEL_API_SECRET=BMvWacw15Et8uFGF
NSW_FUEL_API_AUTH_HEADER=MU1ZU1JBeDV5dnFIVVpjNlZHdHhpeDZvTUEycWdmUlQ6Qk12V2FjdzE1RXQ4dUZHRg==

# --- CORS and rate limiting ---
# Comma-separated browser origins allowed to call the API.
# For production replace with your site origin(s), e.g. https://your.domain.tld:
ALLOWED_ORIGINS=http://localhost:3000
# Comma-separated CIDRs exempt from rate limiting (direct peer IP, never X-Forwarded-For).
# Leave empty outside compose; compose defaults this to the pinned app-network subnet 172.100.0.0/16:
RATE_LIMIT_EXEMPT_CIDRS=
# --- Reverse proxy (production; empty = no proxy, dev default) ---
# Comma-separated addresses/CIDRs of your TLS reverse proxy. Only headers FROM these peers
# are trusted to carry the real client IP (X-Forwarded-For) and scheme (X-Forwarded-Proto).
# Same-host proxy (e.g. Caddy on the compose host): FORWARDING_KNOWN_PROXIES=127.0.0.1
# Separate proxy box: FORWARDING_KNOWN_NETWORKS=10.0.2.50/32 (or its subnet).
# Without this, production behind a proxy rate-limits the proxy instead of real clients, and
# HTTPS scheme detection stays off. Only list peers you control.
FORWARDING_KNOWN_PROXIES=
FORWARDING_KNOWN_NETWORKS=

# --- URLs ---
# Public API base URL, baked into the frontend client bundle at image build time (build arg):
API_BASE_URL=https://your.domain.tld
# Server-side only — base URL the Next.js server uses to reach the API (not browser-visible).
# Consumed by the Next.js server at runtime via compose only (compose defaults to http://backend-prod:5000).
# Host-run frontend dev never reads this file (Next only loads frontend/.env*); put host overrides in
# frontend/.env.development.local — when NEXT_PUBLIC_API_BASE_URL is unset, frontend/lib/api.server.ts
# uses this URL directly for server-side calls:
INTERNAL_API_BASE_URL=http://backend-prod:5000
# Canonical site URL for SEO metadata, sitemap, robots, and OG tags:
SITE_URL=https://your.domain.tld

# --- Victoria (Service Victoria FairFuel) — server-side only, never expose the consumer ID ---
# Apply via the Service Victoria consumer-ID form; leave empty and VIC jobs log a warning and skip:
VIC_FUEL_API_CONSUMER_ID=
# Optional override (default https://api.fuel.service.vic.gov.au/open-data/v1):
# VIC_FUEL_API_BASE_URL=

# --- Western Australia (FuelWatch RSS, no auth required) ---
# Optional overrides (defaults shown):
# WA_FUEL_FEED_ENABLED=true
# WA_FUEL_FEED_BASE_URL=https://www.fuelwatch.wa.gov.au/fuelwatch/fuelWatchRSS

# --- Nominatim geocoding (self-hosted, no auth required) ---
# Optional override (default https://nominatim.fuelwizard.au):
# NOMINATIM_BASE_URL=