# ============================================================
# MEGA Infrastructure — Deployment env template
# ============================================================
# Copy this file to `cooler.env` (which is gitignored) and fill in
# your real values. `cooler.env` is the file you copy-paste into
# Coolify / Vercel / PocketBase env config when deploying.
#
# Generate N8N_INGEST_SECRET with: openssl rand -hex 32
# Then mirror the same string into the n8n workflow's
# Send PDF Callback / Send Image Callback x-ingest-secret header.
#
# Before going to production, rotate every CHANGE_ME line below.
# ============================================================


# ----------------------------------------------------------
# NEXT.JS DASHBOARD (Vercel / host env)
# ----------------------------------------------------------

APP_URL=https://CHANGE_ME.example.com

NEXT_PUBLIC_POCKETBASE_URL=https://CHANGE_ME.example.com

NEXT_PUBLIC_DEFAULT_THEME=light

# Set to users only after the PocketBase login migration and app deployment.
AUTH_MODE=pin

# 4-digit PIN users enter on the login screen.
NEXT_PUBLIC_APP_PIN=CHANGE_ME

# PocketBase admin auth (server-side only). Use email + password
# OR a pre-set admin token — not both.
POCKETBASE_ADMIN_EMAIL=CHANGE_ME@example.com
POCKETBASE_ADMIN_PASSWORD=CHANGE_ME
# POCKETBASE_ADMIN_TOKEN=

# n8n workflow webhook URL. Use the production /webhook/... variant
# once the workflow is Published; /webhook-test/... works without
# publishing for local iteration.
N8N_PO_INGEST_URL=https://CHANGE_ME.example.com/webhook/purchase-order-upload

# Shared secret between Next.js /api/purchase-orders/ingest and the
# n8n callback. MUST match the value in the n8n workflow's Send
# Callback x-ingest-secret header (same value, hardcoded — self-hosted
# Coolify n8n has no $env.* runtime).
N8N_INGEST_SECRET=CHANGE_ME_generate_with_openssl_rand_hex_32


# ----------------------------------------------------------
# POCKETBASE (PocketBase host env, not the dashboard)
# ----------------------------------------------------------
# PB_ADMIN_EMAIL / PB_ADMIN_PASSWORD are used by the dashboard's
# server-side pbAdmin() client (must match POCKETBASE_ADMIN_* above).
# PB_URL is the public-facing PocketBase URL (must match
# NEXT_PUBLIC_POCKETBASE_URL).

PB_URL=https://CHANGE_ME.example.com
PB_ADMIN_EMAIL=CHANGE_ME@example.com
PB_ADMIN_PASSWORD=CHANGE_ME


# ----------------------------------------------------------
# POCKETBASE  (Next.js process-batch + n8n cron)
# ----------------------------------------------------------
# Used by:
#  - Next.js /api/purchase-orders/process-batch to fetch the batch's
#    file from PB when moving it onto the purchase_orders row.
#  - n8n (hardcoded into the workflow's HTTP nodes — see
#    docs/n8n/purchase-order-ingest-implementation.md).
#
# Generate via PocketBase admin > Settings > Admins > "Generate token".
# Both sides must match (Next.js env + n8n workflow hardcoded value).
POCKETBASE_ADMIN_TOKEN=CHANGE_ME_generate_via_PocketBase_admin_ui_Generate_token
# ── Added 2026-09: clock corrections + delivery-note pipeline ──────────
# Server-side copy of the shared PIN (keep equal to NEXT_PUBLIC_APP_PIN).
# Without it the On-site "Needs attention" correction returns 503.
APP_PIN=REPLACE_ME
# Code required to edit a posted receipt. openssl rand -hex 16
RECEIPT_CORRECTION_SECRET=REPLACE_ME
# MEGA VAT number the DN pipeline checks on every slip.
MEGA_CUSTOMER_VAT_NO=4280307796
# dn_batches claimed per /api/dn-batches/tick hit.
DN_TICK_BATCH_SIZE=1
# Staged vs legacy DN tick runner — exactly "true" once the staged
# pipeline is rolled out, else "false". See docs/operations.md §8.
DN_STAGED_INGESTION_ENABLED=false