.env.example

# Local development environment variables for OpenClockwork.
# Copy this file to .env and adjust as needed. .env is gitignored.

# PostgreSQL connection string used by Prisma and the NestJS API.
DATABASE_URL=postgresql://openclockwork:openclockwork@localhost:5432/openclockwork?schema=public

# Port the NestJS API listens on.
API_PORT=3000

# Server wall-clock timezone. Core-time-window detection and the
# 07:00/23:00 off-hours approval threshold reason in local time, so the
# API process must run in the deployment's timezone. Default: Europe/Berlin.
TZ=Europe/Berlin

# Allowed CORS origins for the API (comma-separated). The Vite dev server
# runs on 4200; the full Docker stack exposes the web container on 8080.
API_CORS_ORIGINS=http://localhost:4200,http://localhost:8080

# Expose interactive Swagger docs at /api/docs. Disable for public deployments.
SWAGGER_ENABLED=true

# Static API key for the ERP export endpoint. Rotate per deployment.
ERP_API_KEY=change-me-erp-key

# Static API key for the unattended carry-over-expiry cron caller
# (POST /api/cron/expire-carryovers). In Azure this is set by the
# scheduled ACA Job from a Key Vault secret; locally you only need it
# if you run the cron path manually.
CRON_API_KEY=change-me-cron-key

# JWT signing secret for user sessions. Use a long, random value in production.
JWT_SECRET=change-me-jwt-secret

# Selects the attachment storage backend:
#   local       — LocalFsStorageAdapter (writes under ATTACHMENTS_DIR)
#   azure-blob  — AzureBlobStorageAdapter (managed identity → AZURE_BLOB_ACCOUNT)
STORAGE_BACKEND=local

# Directory where request attachments are written by the LocalFsStorageAdapter.
# Relative paths resolve against the API process CWD. Use a Docker volume or a
# managed disk in production. Ignored when a non-FS StorageAdapter is wired in.
ATTACHMENTS_DIR=data/attachments

# Azure Blob backend (only read when STORAGE_BACKEND=azure-blob). The account
# name + container name come from the Bicep outputs after the first deploy.
# AZURE_BLOB_ACCOUNT=oclockdevxxxxxx
# AZURE_BLOB_CONTAINER=requestattachments

# Destructive public-demo reset. The command refuses to run unless both
# values match exactly. Never configure these in staging or production.
# DEMO_RESET_ENABLED=true
# DEMO_RESET_CONFIRMATION=DELETE-AND-RESEED-OPENClockwork-DEMO