.env.example

# =============================================================================
# ISLAMU Event - Baseline Environment Configuration Template
# =============================================================================
# This file contains the essential baseline configuration keys required to run
# a standard self-hosted deployment (Docker Standalone or Docker Compose).
#
# 📖 CONVENTION OVER CONFIGURATION:
# The platform provides built-in sensible defaults for all advanced dials.
# Advanced settings (e.g. S3 cloud storage, external Cerbos PDP, Infisical vault,
# outbound Svix webhooks, auxiliary moderation profiles, and performance dials)
# are deliberately omitted here to keep setup simple and approachable.
#
# Complete reference for all advanced variables and options:
# 👉 https://islamu.gitbook.io/islamu-event/configuration-and-operations/environment-variables
# =============================================================================

# -----------------------------------------------------------------------------
# 1. Core Networking & Ports
# -----------------------------------------------------------------------------
# Runtime environment: Production | Development
# ASPNETCORE_ENVIRONMENT=Production

# Optional public address override for links and background integrations.
# Setup establishes the BFF request address internally. Never use an internal listening URL.
PUBLIC_BASE_URL=

# Optional dedicated administration origin; Compose defaults to admin.localhost.
# This selects the administration host, not the external fleet-management API.
# INSTANCE_ADMIN_PUBLIC_ORIGIN=http://admin.localhost:7002

# Internal HTTP port bindings for Docker Compose
API_HTTP_PORT=7039
UI_HTTP_PORT=7002
KEYCLOAK_HTTP_PORT=8080

# Multi-tenancy mode: SingleTenant | multi_tenant
# SingleTenant is recommended for single organizations or community centers.
DEPLOYMENT_MODE=SingleTenant

# -----------------------------------------------------------------------------
# 2. Secret Authority Bootstrap
# -----------------------------------------------------------------------------
# Provider authority: Environment (direct .env injection) | Infisical | UserSecrets (dev only)
# For standard self-hosting, we recommend keeping "Environment".
SECRET_PROVIDER=Environment

# -----------------------------------------------------------------------------
# 3. Primary Application Database (PostgreSQL default)
# -----------------------------------------------------------------------------
# Provider: PostgreSql | Sqlite | SqlServer | MariaDb | MySql
DATABASE_PROVIDER=PostgreSql
DATABASE_HOST=postgres
DATABASE_PORT=5432
DATABASE_NAME=islamu_event_db

# Schema namespace boundary (PostgreSQL/SQL Server clean tables)
DATABASE_SCHEMA=islamu_event

# Database credentials (generate secure passwords before production use)
DATABASE_RUNTIME_USERNAME=islamu_event_runtime
DATABASE_RUNTIME_PASSWORD=
DATABASE_MIGRATOR_USERNAME=islamu_event_migrator
DATABASE_MIGRATOR_PASSWORD=

# TLS Mode: Prefer | Required | Disabled (Prefer is default for local, Required for remote)
DATABASE_TLS_MODE=Prefer

# -----------------------------------------------------------------------------
# 4. Authentication Providers
# -----------------------------------------------------------------------------
# Primary provider: local | keycloak | atproto.
# Supported states:
#   local + ATPROTO_LOGIN_ENABLED=false  -> Local Identity only
#   local + ATPROTO_LOGIN_ENABLED=true   -> Local Identity plus AT Protocol
#   keycloak + ATPROTO_LOGIN_ENABLED=false -> Keycloak only
#   keycloak + ATPROTO_LOGIN_ENABLED=true  -> Keycloak plus AT Protocol
#   atproto + ATPROTO_LOGIN_ENABLED=true -> passwordless AT Protocol only
# When atproto is primary, false is rejected and Google SSO is disabled.
AUTHENTICATION_PROVIDER=local
ATPROTO_LOGIN_ENABLED=false

# Optional exact OIDC issuer trust for automatic verified-email account matching.
# Default is empty. Inject into the API/Standalone process environment; for Compose,
# explicitly forward each nonempty indexed variable through your service override.
# IDENTITYCORRELATION__TRUSTEDISSUERS__0=https://identity.example.org/realms/community

# Optional configured-administrator bootstrap. Leave blank for interactive
# setup; values are copied as names only and never emitted in diagnostics.
# Provider: local | keycloak | atproto. Local uses a stable UUIDv7 subject
# as its username; credential email is optional and separate from legal contact.
INSTANCE_BOOTSTRAP_ADMIN_PROVIDER=
INSTANCE_BOOTSTRAP_ADMIN_SUBJECT=
INSTANCE_BOOTSTRAP_BINDING_GENERATION=
INSTANCE_BOOTSTRAP_ADMIN_EMAIL=
INSTANCE_BOOTSTRAP_ADMIN_FIRST_NAME=
INSTANCE_BOOTSTRAP_ADMIN_LAST_NAME=
# Required only for configured Local bootstrap. Supply through the selected
# secret authority; first-use replacement is required before ordinary sign-in.
INSTANCE_BOOTSTRAP_LOCAL_PASSWORD=

# Development-only opt-in. The isolated local-agent profile requires true;
# normal deployment must leave this false. Initialization secrets come only
# from the selected authority and are not reread after persona completion.
AGENT_BROWSER_SEED_ENABLED=false
AGENT_BROWSER_PERSONA_PASSWORD=
# Required only by the dedicated agent cache; supply through the selected authority.
AGENT_BROWSER_REDIS_PASSWORD=

# Embedded Local Identity JWT signing key. Required when the primary provider is local.
# Generate with: openssl rand -base64 64
AUTHENTICATION_LOCAL_JWT_KEY=
AUTHENTICATION_LOCAL_LOCKOUT_THRESHOLD=5
AUTHENTICATION_LOCAL_LOCKOUT_DURATION_MINUTES=15

# Local Identity database topology: colocated (recommended) | external
# Keep 'colocated' for single-instance deployments so credentials share the primary DB.
# Set 'external' only when sharing a central identity database across multiple solutions (e.g. across ISLAMU solutions).
# WARNING: Do NOT blindly mirror with ERASURE_DATABASE_TOPOLOGY (which recommends EmbeddedSqlite for anti-resurrection isolation).
IDENTITY_DATABASE_TOPOLOGY=colocated

# Keycloak configuration. Required only when AUTHENTICATION_PROVIDER=keycloak.
# Base URL of Keycloak
KEYCLOAK_ENDPOINT=http://localhost:8080
KEYCLOAK_REALM=islamu

# OIDC confidential client for the Blazor BFF. Event startup never imports or
# changes a realm. An explicitly approved absent-client create uses this value;
# rotate Keycloak and this deployment value together, then restart.
KEYCLOAK_BLAZOR_CLIENT_ID=event-blazor
# Generate with: openssl rand -hex 32
KEYCLOAK_BLAZOR_CLIENT_SECRET=

# Dedicated Keycloak database credentials (used by Compose keycloak-db service)
KEYCLOAK_DB_DATABASE=keycloak
KEYCLOAK_DB_USERNAME=keycloak
KEYCLOAK_DB_PASSWORD=

# Initial Keycloak administrator account (consumed by Keycloak, never Event)
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=

# -----------------------------------------------------------------------------
# 5. Storage (Local Filesystem default)
# -----------------------------------------------------------------------------
# Select local or S3 storage through the application storage setting.
# For S3 cloud storage (MinIO, AWS S3, Cloudflare R2), see public documentation.
LOCAL_STORAGE_ROOT_PATH=/app/storage-data/local

# -----------------------------------------------------------------------------
# 6. Optional Email
# -----------------------------------------------------------------------------
# Zero-email baseline: persisted email.delivery_enabled defaults to false.
# Configure SMTP and explicitly enable delivery through instance admin settings;
# environment values and starting Mailpit do not enable or re-enable delivery.
# Supply SMTP credentials separately through the selected secret authority.
# Optional local capture: docker compose --profile mail up -d mailpit
# Inbox: http://127.0.0.1:8025; container-only SMTP: mailpit:1025, security None.
# Capture is limited to 500 messages in the mailpit_data volume, not real delivery.
# The base Compose topology has no RabbitMQ broker.
EMAIL_DISPATCH_RABBITMQ_ENABLED=false

# -----------------------------------------------------------------------------
# 7. Privacy Erasure Authority (GDPR & Anti-Resurrection)
# -----------------------------------------------------------------------------
# Storage topology: EmbeddedSqlite (recommended default) | CoLocated | ExternalDatabase
# Recommended: EmbeddedSqlite (dedicated local file outside the primary database).
# This prevents post-backup GDPR user erasures from being accidentally resurrected
# if the primary database is ever restored from a backup.
# WARNING: Do NOT blindly match with IDENTITY_DATABASE_TOPOLOGY (which recommends colocated).
ERASURE_DATABASE_TOPOLOGY=EmbeddedSqlite
ERASURE_EMBEDDED_PATH=/app/data/privacy_erasure_authority.db

# Reserved FUTURE moderation recognition anchors; optional for ordinary erasure
# and startup. If provisioned, supply base64-encoded 32 random bytes through the
# selected secret authority (Infisical /api, Environment, or explicitly selected
# shared UserSecrets in Development/Testing only). Preserve the same key and
# nonsecret ID across replicas, restart, restore, and supported backups.
# Never rotate while retained fingerprints or supported backups depend on it.
PRIVACY_ERASURE_IDENTITY_FENCE_KEY_ID=
PRIVACY_ERASURE_IDENTITY_FENCE_KEY=

# External authority database (PostgreSQL only). Used only when
# ERASURE_DATABASE_TOPOLOGY=ExternalDatabase; ignored by EmbeddedSqlite and CoLocated.
# Runtime and migrator logins must be distinct roles.
# ERASURE_DATABASE_HOST=privacy-erasure-db
# ERASURE_DATABASE_PORT=5432
# ERASURE_DATABASE_NAME=islamu_event_privacy_erasure
# ERASURE_DATABASE_TLS_MODE=Prefer
# ERASURE_DATABASE_TRUST_SERVER_CERTIFICATE=false
# ERASURE_DATABASE_RUNTIME_USERNAME=privacy_erasure_runtime
# ERASURE_DATABASE_RUNTIME_PASSWORD=
# ERASURE_DATABASE_MIGRATOR_USERNAME=privacy_erasure_migrator
# ERASURE_DATABASE_MIGRATOR_PASSWORD=

# -----------------------------------------------------------------------------
# 8. First-Run Setup & Administrator Bootstrap
# -----------------------------------------------------------------------------
# Leave SETUP_SECRET blank to generate a single-use secret in the volume on first boot,
# or set an explicit pre-shared key here to unlock /setup.
SETUP_SECRET=

# Bootstrap Mode: Interactive (default web wizard at /setup) | ConfiguredAdministrator (headless)
INSTANCE_BOOTSTRAP_MODE=

# -----------------------------------------------------------------------------
# 9. Operator Legal Identity (Optional Configured-Administrator Bootstrap Seed)
# -----------------------------------------------------------------------------
# Runtime operator identity is stored in the database and configured via the /setup
# onboarding wizard or /admin/instance. These environment variables are optional and
# only used during headless ConfiguredAdministrator bootstrap or to seed first-run
# identity. They do NOT override an already-completed instance.
#
# Unique UUIDv7 identifier for the operating legal entity
INSTANCE__OPERATORIDENTITY__OPERATORID=01912a7e-1234-7000-8000-000000000001
INSTANCE__OPERATORIDENTITY__PUBLICNAME=Community Events Foundation
INSTANCE__OPERATORIDENTITY__LEGALNAME=Community Events Foundation Non-Profit
INSTANCE__OPERATORIDENTITY__ISOFFICIALINSTANCE=false
# Required even for independent instances: replace with your public HTTPS origin,
# without a path or query. This does not declare official-instance status.
INSTANCE__OPERATORIDENTITY__OFFICIALORIGIN=https://example.org
# Use your actual legal form: registered_organization | sole_trader | individual |
# public_body | unincorporated_association.
INSTANCE__OPERATORIDENTITY__OPERATORKINDCODE=registered_organization
INSTANCE__OPERATORIDENTITY__JURISDICTIONCOUNTRYCODE=US
INSTANCE__OPERATORIDENTITY__PUBLICCONTACTEMAIL=contact@example.org
INSTANCE__OPERATORIDENTITY__WEBSITEURL=https://example.org
INSTANCE__OPERATORIDENTITY__LEGALNOTICEURL=https://example.org/legal
INSTANCE__OPERATORIDENTITY__TERMSURL=https://example.org/terms
INSTANCE__OPERATORIDENTITY__PRIVACYURL=https://example.org/privacy

# -----------------------------------------------------------------------------
# 10. Configuration Manifest Bootstrap
# -----------------------------------------------------------------------------
CONFIGURATION_MANIFEST_MODE=Off
CONFIGURATION_MANIFEST_PATH=/etc/islamu-event/bootstrap/configuration-manifest.json
CONFIGURATION_MANIFEST_HOST_DIRECTORY=./deploy/bootstrap