# Local-dev secrets and ports for `infra/local/dev.compose.yml`.
# Copy to `.env` (which is git-ignored) and adjust as needed.
#
#   cp .env.example .env
#   $EDITOR .env

# ---------------------------------------------------------------- Postgres
# `POSTGRES_PASSWORD` is mandatory — the compose refuses to boot
# without it.
#
# Picking a password — keep it URL-safe in dev. The BFF reads its
# Postgres URL via `DATABASE_URL` and Prisma demands the URL form;
# any `@`, `#`, `:`, `/`, `?`, `%`, `&`, `=`, `+`, `;` in the
# password must be URL-encoded in `apps/portal-bff/.env`. Easiest
# avoided by sticking to alphanumerics + `-_.~` in dev.
POSTGRES_USER=portal
POSTGRES_PASSWORD=portal_dev_change_me
POSTGRES_DB=portal_dev
POSTGRES_PORT=5432

# ---------------------------------------------------------------- Redis
# Same — mandatory.
REDIS_PASSWORD=redis_dev_change_me
REDIS_PORT=6379

# ---------------------------------------------------------------- OTel
OTEL_GRPC_PORT=4317
OTEL_HTTP_PORT=4318

# ---------------------------------------------------------------- Optional viewers / tooling
# Only consumed when the matching Compose profile is activated:
#   --profile dbtools       → pgweb
#   --profile observability → Jaeger UI
#   --profile serve-static  → Caddy serving the production build
PGWEB_PORT=8081
JAEGER_UI_PORT=16686
SERVE_STATIC_PORT=4200

# ---------------------------------------------------------------- Apps (`--profile apps`)
# Two access modes for the SPA dev-servers — pick one. The switch
# happens entirely in this file (compose interpolates the SPA's nx
# serve --configuration AND the BFF's ENTRA_*_REDIRECT_URI from here);
# `apps/portal-bff/.env` stays at its localhost defaults regardless.
# See infra/README.md → "Switching between dev modes".

# === Mode A — Localhost / VSCode port-forwarding (DEFAULT) ===
# Leave the entire Mode B block below commented. The SPA dev-servers
# stay on plain HTTP, the BFF receives the `http://localhost:*`
# redirect URIs already registered in Entra. Browse `http://
# localhost:4200/` from the workstation — VSCode Remote-SSH auto-
# forwards 4200 / 4300 / 3000 from the VM.

# === Mode B — HTTPS via hostname (apf-portal.dev-XX.local) ===
# Required when the SPA is accessed via a hostname (Entra refuses
# `http:` for non-`localhost` redirect URIs — see the team mkcert CA
# setup in infra/README.md). Replace `dev-jg` with YOUR hostname and
# uncomment the five lines.
#
# NX_SERVE_CONFIGURATION=https
# ENTRA_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/api/auth/callback
# ENTRA_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4200/
# ENTRA_ADMIN_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/api/admin/auth/callback
# ENTRA_ADMIN_POST_LOGOUT_REDIRECT_URI=https://apf-portal.dev-jg.local:4300/