# Managed by Ansible — 0600.
# Sourced by shithubd-worker.service via EnvironmentFile=.
#
# Naming contract: see web.env.j2 — env vars match docs/internal/config.md.
# Misnamed env vars are silently ignored; the binary falls back to defaults.

SHITHUB_DATABASE_URL=postgresql://shithub:{{ shithub_db_password }}@127.0.0.1:5432/shithub?sslmode=disable

SHITHUB_AUTH__BASE_URL=https://{{ shithub_domain }}
SHITHUB_AUTH__SITE_NAME=shithub
SHITHUB_AUTH__EMAIL_FROM={{ shithub_email_from }}
SHITHUB_AUTH__EMAIL_BACKEND={{ shithub_email_backend }}

SHITHUB_STORAGE__REPOS_ROOT={{ shithub_data_root }}/repos
{% if s3_bucket | default("") %}
# DigitalOcean Spaces runtime bucket via its S3-compatible API.
SHITHUB_STORAGE__S3__ENDPOINT={{ s3_endpoint }}
SHITHUB_STORAGE__S3__REGION={{ s3_region | default("us-east-1") }}
SHITHUB_STORAGE__S3__ACCESS_KEY_ID={{ s3_access_key_id }}
SHITHUB_STORAGE__S3__SECRET_ACCESS_KEY={{ s3_secret_access_key }}
SHITHUB_STORAGE__S3__BUCKET={{ s3_bucket }}
SHITHUB_STORAGE__S3__USE_SSL={{ (s3_use_ssl | default(true)) | ternary("true", "false") }}
SHITHUB_STORAGE__S3__FORCE_PATH_STYLE={{ (s3_force_path_style | default(false)) | ternary("true", "false") }}
{% endif %}

SHITHUB_TOTP_KEY={{ shithub_totp_key_b64 }}

{% if shithub_email_backend == "postmark" %}
SHITHUB_AUTH__POSTMARK__SERVER_TOKEN={{ shithub_postmark_token }}
{% elif shithub_email_backend == "resend" %}
SHITHUB_AUTH__RESEND__API_KEY={{ shithub_resend_api_key }}
{% endif %}