PORT=3000

# Write model (commands)
POSTGRES_URL=postgres://taskstream:taskstream@localhost:5432/taskstream
# Creates/updates tables from the entities. Use migrations in production.
POSTGRES_SYNCHRONIZE=true

# Read model (queries)
MONGO_URL=mongodb://localhost:27017/taskstream_read

# Event stream (write → read), GraphQL pub/sub and session cache
REDIS_URL=redis://localhost:6379
EVENT_STREAM_KEY=task-stream:events
# Set to false on API-only instances when the events bridge (projections) runs elsewhere
EVENTS_BRIDGE_ENABLED=true

# Pireon identity server (https://oauth.pireon.dev/api/documentation)
PIREON_BASE_URL=https://oauth.pireon.dev
# Secret returned when registering the webhook (POST /api/clients/{client}/webhooks)
PIREON_WEBHOOK_SECRET=
# OAuth clients of task-stream in Pireon (POST /api/clients). Each Pireon client allows ONE grant type:
#   authorization_code → "Sign in with Pireon" and Swagger UI. Redirect URIs to register:
#     http://localhost:4200/auth/callback, http://localhost:3000/api/docs/oauth2-redirect.html
PIREON_CLIENT_ID=
PIREON_CLIENT_SECRET=
#   password → email + password sign-in (defaults to the client above when empty)
PIREON_PASSWORD_CLIENT_ID=
PIREON_PASSWORD_CLIENT_SECRET=
PIREON_SCOPES=users:read
PIREON_PASSWORD_GRANT=true
AUTH_SESSION_TTL_SECONDS=60

GRAPHQL_PLAYGROUND=true

# REST + OpenAPI for other apps (Swagger UI at /api/docs). The document is also written to OPENAPI_FILE.
SWAGGER_ENABLED=true
OPENAPI_FILE=apps/api/openapi.json

# Docker builds only: token of Pireon's Nexus for @pi/ui (build secret, never stored in an image).
# Locally: export NEXUS_TOKEN=$(grep '^//nexus.pireon.dev/repository/npm-releases/:_authToken=' ~/.npmrc | cut -d= -f2-)
NEXUS_TOKEN=