# Compass / NHS — service environment (EXAMPLE).
#
# Copy to environment.d/school-service.env and fill the secrets in. The real
# file is gitignored; never commit it. Generate values with:
#   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 gen-secret
#   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 hash-password 'the-password'

# Listen address inside the container. The host maps 8792 -> 8792.
SCHOOL_ADDR=:8792

# SQLite database in the named volume.
SCHOOL_DB_PATH=/data/school.db

# Signs the session cookie. Required, >= 16 characters. Secret.
SCHOOL_SESSION_SECRET=change-me-32-bytes-of-random

# The single dashboard login (Sam). Prefer the bcrypt hash over the plaintext.
SCHOOL_ADMIN_USERNAME=sam
SCHOOL_ADMIN_PASSWORD_HASH=
SCHOOL_ADMIN_PASSWORD=

# Keep true behind HTTPS (Caddy terminates TLS).
SCHOOL_COOKIE_SECURE=true
SCHOOL_SESSION_TTL=12h

# Family timezone for due dates and briefs.
SCHOOL_TIMEZONE=Australia/Sydney

SCHOOL_LOG_LEVEL=info
SCHOOL_APP_ENV=production

# ---- Home Assistant calendar (AGENTS.md §4 FR-8, Phase 6) -------------------
# Important school events are written to Sam's Home Assistant calendar through
# the Home Assistant REST API. Nothing is written until all three of URL, token
# and entity are set; the dashboard shows CALENDAR NOT CONFIGURED until then.
#
# The token is a long-lived access token created on Sam's Home Assistant
# profile page. It is a SECRET: keep it in this file only.
SCHOOL_HA_URL=http://192.168.20.30:8123
SCHOOL_HA_TOKEN=
# The calendar entity to write to. Discover the real ids with:
#   scripts/calendar-push.sh entities
SCHOOL_HA_CALENDAR_ENTITY=calendar.school
# The internal .lab Caddy certificate is not in the container trust store.
# Set true only when SCHOOL_HA_URL is the https://homeassistant.home.lab URL.
SCHOOL_HA_INSECURE=false
SCHOOL_HA_TIMEOUT=20s

# ---- Apprise notifications (AGENTS.md §4 FR-9/FR-14, §11 Phase 7) ----------
# The morning briefs go out through the house Apprise API on `.35:8210`. The
# Apprise configuration holds every destination (email address, WhatsApp number,
# SMTP password); this service only names a tag such as "harry_email", so no
# address or password is ever stored here or committed (AGENTS.md §10 rule 3).
#
# Create the stored configuration once in the Apprise web UI
# (https://apprise.lab.audasmedia.com.au), then copy its key here. The key acts
# like a password: keep it in this file only, never in git.
SCHOOL_APPRISE_URL=http://192.168.20.35:8210
SCHOOL_APPRISE_KEY=
# Optional bearer token if the Apprise API is protected. Empty in this lab.
SCHOOL_APPRISE_TOKEN=
SCHOOL_APPRISE_TIMEOUT=15s

# Channels the morning brief uses (AGENTS.md §13 decision 8). Each recipient
# needs a tag per channel: <tag base>_email and <tag base>_whatsapp.
SCHOOL_APPRISE_CHANNELS=email,whatsapp

# Recipients: Name=tag-base. The boys are children in the database and get their
# own brief; the rest are parents and get one combined brief (FR-9, FR-14).
SCHOOL_APPRISE_TAGS=Harry=harry,Finn=finn,Jo=joanna,Sam=sam
SCHOOL_APPRISE_PARENTS=Jo,Sam

# Bearer token for POST /notify/morning, the endpoint n8n calls at 6:00am.
# Generate one and keep it here:
#   docker run --rm --entrypoint /app/school <image> gen-secret
SCHOOL_NOTIFY_TOKEN=

# ---- Hub API (AGENTS.md §4 FR-11, §11 Phase 8) ------------------------------
# The shared token the Hub sends to GET /capabilities, POST /ask (read-only) and
# POST /notify. It is a SECRET: keep it in this file only, never in git.
#
# The Hub holds the same value as HUB_PROJECT_COMPASS_NHS_TOKEN in
# ~/.config/environment.d/10-secrets.conf, and reaches this service through
# HUB_PROJECTS=compass_nhs=http://192.168.20.13:8792. Generate one with:
#   head -c 32 /dev/urandom | base64 | tr -d '=+/' | cut -c1-40
# An empty value turns the three Hub endpoints off with 503; the dashboard is
# unaffected.
SCHOOL_HUB_TOKEN=