.env.example

# ============================================================
# ReadMates Environment Example
# ------------------------------------------------------------
# 섹션 순서:
#   1) Spring server (필수)
#   2) Auth & BFF (필수)
#   3) Frontend / Cloudflare Pages (필수)
#   4) Local MySQL (compose dev)
#   5) Redis (optional)
#   6) Kafka & Notifications (optional)
#   7) AI 세션 생성 (optional)
#   8) SMTP (notifications 사용 시 필수)
#   9) OCI Compose stack (배포 시)
#  10) Legacy / rollback
# ============================================================

# ----- 1) Spring server -----
# 출처: prod 는 GitHub Secrets (SPRING_DATASOURCE_*); 로컬은 compose.override.yml 의 mysql 컨테이너와 매칭.
SPRING_PROFILES_ACTIVE=prod
SPRING_DATASOURCE_URL=jdbc:mysql://<mysql-private-host>:3306/readmates?useSSL=true&serverTimezone=UTC
SPRING_DATASOURCE_USERNAME=readmates
SPRING_DATASOURCE_PASSWORD=<db-password>

# ----- 2) Auth & BFF -----
# 출처: 모든 *_SECRET 은 GitHub Secrets, base URL/origin/secure 토글은 GitHub Variables.
# Primary base URL for both app and OAuth redirect.
READMATES_APP_BASE_URL=https://readmates.pages.dev
READMATES_AUTH_BASE_URL=https://readmates.pages.dev
# HMAC secret for OAuth return-state signing.
READMATES_AUTH_RETURN_STATE_SECRET={return-state-signing-secret}
READMATES_ALLOWED_ORIGINS=https://readmates.pages.dev
# Shared secret between Cloudflare Pages Functions and Spring BFF.
READMATES_BFF_SECRET=<shared-bff-secret>
# Optional rotation list (comma-separated, primary first). Takes priority over READMATES_BFF_SECRET when set.
READMATES_BFF_SECRETS=
READMATES_BFF_SECRET_REQUIRED=true
# Production release gate: only the current browser bundle + Pages BFF may mutate /api/host/**.
# Keep false for direct local API work; sync-config pins production to true.
READMATES_HOST_WRITE_CLIENT_CONTRACT_REQUIRED=false
# rotation-only: 회전 중 secondary 사용도 감사. all: 모든 인증을 감사.
READMATES_SECURITY_BFF_AUDIT_MODE=rotation-only
READMATES_AUTH_SESSION_COOKIE_SECURE=true
# Seed for deterministic IP hashing in audit logs.
READMATES_IP_HASH_BASE_SECRET=<ip-hash-base-secret>
# Google OAuth client (web).
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_GOOGLE_CLIENT_ID=<google-oauth-client-id>
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_GOOGLE_CLIENT_SECRET=<google-oauth-client-secret>
SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_GOOGLE_SCOPE=openid,email,profile

# ----- 3) Frontend / Cloudflare Pages -----
# 출처: 프론트는 Cloudflare Pages env (deploy-front.yml) 가 관리. 이 파일에는 참고용으로만.
# Vite-only flag for local dev login fixture.
VITE_ENABLE_DEV_LOGIN=false
# Non-secret local switch. Real Google credentials stay in the Spring backend only.
VITE_ENABLE_GOOGLE_LOGIN=false
VITE_PUBLIC_PRIMARY_DOMAIN={primary-domain}
# BFF → Spring upstream URL (Pages Functions에서 사용).
READMATES_API_BASE_URL=https://api.example.com
# Pages Functions side BFF secret (서버와 동일 값 / 회전 리스트).
# READMATES_BFF_SECRET / READMATES_BFF_SECRETS 는 위 2) 섹션과 공유.
# 회전 단계 표시: stable / rotating / completed.
BFF_SECRET_ROTATION_STAGE=stable

# ----- 4) Local MySQL (compose dev) -----
# 출처: LOCAL ONLY — 운영은 OCI MySQL 서비스를 사용, GitHub Secrets에 SPRING_DATASOURCE_* 등록.
# compose.yml 에서 참조. .env로 복사할 변수만 골라 쓰세요.
READMATES_LOCAL_MYSQL_ROOT_PASSWORD=<ci-mysql-password>
READMATES_LOCAL_MYSQL_DATABASE=readmates
READMATES_LOCAL_MYSQL_USERNAME=readmates
READMATES_LOCAL_MYSQL_PASSWORD=readmates
READMATES_LOCAL_MYSQL_PORT=3306

# ----- 5) Redis (optional cache + rate limit) -----
# 출처: 로컬은 compose 의 redis 컨테이너. 운영 토글은 GitHub Variables.
READMATES_REDIS_ENABLED=false
READMATES_REDIS_URL=redis://redis:6379
READMATES_REDIS_COMMAND_TIMEOUT=250ms
READMATES_RATE_LIMIT_ENABLED=false
# fail-closed for sensitive endpoints when Redis is unreachable.
READMATES_RATE_LIMIT_FAIL_CLOSED_SENSITIVE=false
READMATES_AUTH_SESSION_CACHE_ENABLED=false
READMATES_PUBLIC_CACHE_ENABLED=false
READMATES_NOTES_CACHE_ENABLED=false

# ----- 6) Kafka & Notifications (optional) -----
# 출처: 토글/토픽명은 GitHub Variables. SMTP 자격증명은 섹션 8) 참고.
READMATES_NOTIFICATIONS_ENABLED=false
READMATES_KAFKA_ENABLED=false
READMATES_KAFKA_BOOTSTRAP_SERVERS=redpanda:9092
READMATES_KAFKA_NOTIFICATION_EVENTS_TOPIC=readmates.notification.events.v1
READMATES_KAFKA_NOTIFICATION_DLQ_TOPIC=readmates.notification.events.dlq.v1
READMATES_KAFKA_NOTIFICATION_CONSUMER_GROUP=readmates-notification-dispatcher
READMATES_KAFKA_NOTIFICATION_RELAY_BATCH_SIZE=50
READMATES_KAFKA_NOTIFICATION_MAX_PUBLISH_ATTEMPTS=5
READMATES_KAFKA_NOTIFICATION_SEND_TIMEOUT=10s
# Shared relay and delivery retry schedule, in whole minutes.
READMATES_NOTIFICATION_RETRY_DELAY_MINUTES=5,15,60,240
READMATES_NOTIFICATION_MAX_DELIVERY_ATTEMPTS=5
READMATES_NOTIFICATION_WORKER_FIXED_DELAY_MS=30s
READMATES_NOTIFICATION_CLAIM_LEASE=15m
READMATES_NOTIFICATION_EVENT_MAX_AGE=24h
READMATES_NOTIFICATION_DELIVERY_MAX_AGE=24h
READMATES_NOTIFICATION_BACKLOG_REFRESH_INTERVAL=60s
READMATES_NOTIFICATION_BACKLOG_INITIAL_DELAY=5s
READMATES_NOTIFICATION_ADMIN_REPLAY_PREVIEW_TTL=10m
READMATES_NOTIFICATION_ADMIN_REPLAY_MAX_TARGETS=1000
READMATES_NOTIFICATION_SENDER_NAME=ReadMates
READMATES_NOTIFICATION_SENDER_EMAIL=no-reply@example.com

# ----- 7) AI 세션 생성 (optional, in-app AI session import) -----
# 출처: API 키 3종은 GitHub Secrets (READMATES_AIGEN_*_API_KEY). 토글/모델명은 GitHub Variables.
# Kill switch (기본 false). true 로 두어야 컨트롤러 빈이 등록됩니다.
READMATES_AIGEN_ENABLED=false
# 허용 provider 화이트리스트 (콤마 구분, 비우면 kill switch 와 동일).
# 예: OPENAI / OPENAI,CLAUDE / OPENAI,CLAUDE,GEMINI
READMATES_AIGEN_ENABLED_PROVIDERS=
# Fail-closed operational invariant. Set true only after confirming that the
# Gemini API key's Cloud project has active paid-tier retention terms.
READMATES_AIGEN_GOOGLE_PAID_TIER_RETENTION_CONFIRMED=false
# 호스트가 모델을 명시하지 않고 클럽 기본도 없을 때 사용하는 fallback.
# application.yml 기본값(`gpt-5.4-mini`)을 override 하려면 여기서 지정.
READMATES_AIGEN_FALLBACK_DEFAULT_MODEL=gpt-5.4-mini
# Grounded whole-transcript application output reserve. It may be lowered for
# an environment but must never be raised above the verified 16,384 ceiling.
READMATES_AIGEN_GROUNDED_RESERVED_OUTPUT_TOKENS=16384
# Provider API key — 사용 안 하는 provider는 비워두면 됩니다.
READMATES_AIGEN_OPENAI_API_KEY=<openai-api-key>
READMATES_AIGEN_ANTHROPIC_API_KEY=
READMATES_AIGEN_GEMINI_API_KEY=
# Kafka 비활성 시 단일 인스턴스 inline 실행 (개발용). 운영은 true + bootstrap 필요.
READMATES_AIGEN_KAFKA_ENABLED=false
READMATES_AIGEN_KAFKA_BOOTSTRAP_SERVERS=
READMATES_AIGEN_KAFKA_CONSUMER_RETRY_DELAY=5s
READMATES_AIGEN_KAFKA_CONSUMER_MAX_ATTEMPTS=10
READMATES_AIGEN_PROCESSING_DEADLINE=20m
READMATES_AIGEN_RECOVERY_FIXED_DELAY=1m
READMATES_AIGEN_RECOVERY_BATCH_SIZE=50
READMATES_AIGEN_RECOVERY_INDEX_REPAIR_BATCH_SIZE=500
READMATES_AIGEN_RECOVERY_INDEX_REPAIR_MAX_MEMBERS=5000
READMATES_AIGEN_QUEUE_PROBE_FIXED_DELAY=30s

# ----- 8) SMTP (notifications 사용 시 필수) -----
# 출처: USERNAME/PASSWORD 는 GitHub Secrets, 호스트/포트는 GitHub Variables.
SPRING_MAIL_HOST=smtp.email.oci-region.oci.oraclecloud.com
SPRING_MAIL_PORT=587
SPRING_MAIL_USERNAME=<oci-smtp-username>
SPRING_MAIL_PASSWORD=<oci-smtp-password>
SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH=true
SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE=true
SPRING_MAIL_PROPERTIES_MAIL_SMTP_CONNECTIONTIMEOUT=5s
SPRING_MAIL_PROPERTIES_MAIL_SMTP_TIMEOUT=5s
SPRING_MAIL_PROPERTIES_MAIL_SMTP_WRITETIMEOUT=5s

# ----- 9) OCI Compose stack -----
# 출처: GitHub Variables (CADDY_SITE, READMATES_SERVER_IMAGE).
CADDY_SITE=api.example.com
READMATES_SERVER_IMAGE=readmates-server:local

# ----- 10) (deprecated) Legacy host JAR mode -----
# 더 이상 사용하지 않습니다. compose stack 만 운영.
# Compose stack overrides these in deploy/oci/compose.yml.
READMATES_MANAGEMENT_ADDRESS=127.0.0.1
READMATES_MANAGEMENT_PORT=8081