# Local-dev secrets and ports for `infra/local/dev.compose.yml`.
# Copy to `.env` (which is git-ignored) and adjust as needed.
#
#   cp .env.example .env
#   $EDITOR .env

# ---------------------------------------------------------------- Postgres
# `POSTGRES_PASSWORD` is mandatory — the compose refuses to boot
# without it.
#
# Picking a password — keep it URL-safe in dev. The BFF reads its
# Postgres URL via `DATABASE_URL` and Prisma demands the URL form;
# any `@`, `#`, `:`, `/`, `?`, `%`, `&`, `=`, `+`, `;` in the
# password must be URL-encoded in `apps/portal-bff/.env`. Easiest
# avoided by sticking to alphanumerics + `-_.~` in dev.
POSTGRES_USER=portal
POSTGRES_PASSWORD=portal_dev_change_me
POSTGRES_DB=portal_dev
POSTGRES_PORT=5432

# ---------------------------------------------------------------- Redis
# Same — mandatory.
REDIS_PASSWORD=redis_dev_change_me
REDIS_PORT=6379

# ---------------------------------------------------------------- OTel
OTEL_GRPC_PORT=4317
OTEL_HTTP_PORT=4318

# ---------------------------------------------------------------- Optional viewers / tooling
# Only consumed when the matching Compose profile is activated:
#   --profile dbtools       → pgweb
#   --profile observability → Jaeger UI
#   --profile serve-static  → Caddy serving the production build
PGWEB_PORT=8081
JAEGER_UI_PORT=16686
SERVE_STATIC_PORT=4200

# ---------------------------------------------------------------- Apps (`--profile apps`)
# Nx serve configuration for the SPA dev-servers. Two values matter:
#   - `development` (default) — plain HTTP. Use with `localhost`
#                               browser access; Entra accepts
#                               `http://localhost:*` redirect URIs.
#   - `https`                 — TLS-terminating dev-server using the
#                               cert at `.secrets/dev-tls.{key,pem}`.
#                               Required when accessing the SPA via a
#                               hostname (e.g. `apf-portal.dev.local`)
#                               since Entra rejects `http:` for any
#                               non-`localhost` redirect URI. See the
#                               "HTTPS dev-server setup" section of
#                               infra/README.md for the mkcert
#                               procedure and how to wire the
#                               matching `ENTRA_REDIRECT_URI` value.
# NX_SERVE_CONFIGURATION=https