# Production .env for deploy/docker-compose.cdn-mm.yml
# (CDN Manager + MikrotikManager + one Traefik).
# Copy to /opt/cdn-mm/.env and fill secrets. Do not commit.

# --- Traefik / Let's Encrypt (Cloudflare DNS-01) ---
# Token for ACME only (Zone DNS Edit). Separate from CLOUDFLARE_API_TOKEN below.
CF_DNS_API_TOKEN=
LETSENCRYPT_EMAIL=admin@shnt.top
# TRAEFIK_IMAGE_TAG=v3.7
# TRAEFIK_HTTP_PORT=80
# TRAEFIK_HTTPS_PORT=443
# TRAEFIK_LOG_LEVEL=INFO

# --- Public hosts ---
CDN_DOMAIN=cdn.shnt.top
MM_DOMAIN=mm.shnt.top
# Must match MM UI origin (https:// + MM_DOMAIN).
CORS_ORIGIN=https://mm.shnt.top

# --- Images ---
CDN_IMAGE_TAG=latest
# drop-in alias (same manifest): git.shx.one/denozord/cdn-manager
MM_BACKEND_IMAGE_TAG=latest
MM_FRONTEND_IMAGE_TAG=latest
MM_UPDATER_IMAGE_TAG=latest

# --- CDN Manager ---
CLOUDFLARE_API_TOKEN=
LOG_LEVEL=info
NODE_ENV=production

# Portal SSO (prod default AUTH_REQUIRED=true)
AUTH_REQUIRED=true
# Same HS256 secret as auth-portal JWT_SECRET (required)
AUTH_JWT_SECRET=
# Optional alias — CDN Manager also reads JWT_SECRET
JWT_SECRET=
AUTH_ISSUER=https://auth.shnt.top
AUTH_PORTAL_URL=https://auth.shnt.top
# Shared with auth-portal AUDIT_INGEST_SECRET (optional)
AUTH_AUDIT_INGEST_SECRET=

# Legacy local admin — only when AUTH_REQUIRED=false
ADMIN_USERNAME=admin
ADMIN_PASSWORD_HASH=

# --- MikrotikManager updater (optional; private registry pull) ---
REGISTRY_USERNAME=
REGISTRY_PASSWORD=
# POLL_INTERVAL_SECONDS=300
# HEALTH_TIMEOUT_SECONDS=120
# STOP_TIMEOUT_SECONDS=30