# Compass / NHS — service environment (EXAMPLE).
#
# Copy to environment.d/school-service.env and fill the secrets in. The real
# file is gitignored; never commit it. Generate values with:
#   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 gen-secret
#   docker run --rm --entrypoint /app/school compass-teams-nhs/school:0.1.0-phase1 hash-password 'the-password'

# Listen address inside the container. The host maps 8792 -> 8792.
SCHOOL_ADDR=:8792

# SQLite database in the named volume.
SCHOOL_DB_PATH=/data/school.db

# Signs the session cookie. Required, >= 16 characters. Secret.
SCHOOL_SESSION_SECRET=change-me-32-bytes-of-random

# The single dashboard login (Sam). Prefer the bcrypt hash over the plaintext.
SCHOOL_ADMIN_USERNAME=sam
SCHOOL_ADMIN_PASSWORD_HASH=
SCHOOL_ADMIN_PASSWORD=

# Keep true behind HTTPS (Caddy terminates TLS).
SCHOOL_COOKIE_SECURE=true
SCHOOL_SESSION_TTL=12h

# Family timezone for due dates and briefs.
SCHOOL_TIMEZONE=Australia/Sydney

SCHOOL_LOG_LEVEL=info
SCHOOL_APP_ENV=production

# ---- Home Assistant calendar (AGENTS.md §4 FR-8, Phase 6) -------------------
# Important school events are written to Sam's Home Assistant calendar through
# the Home Assistant REST API. Nothing is written until all three of URL, token
# and entity are set; the dashboard shows CALENDAR NOT CONFIGURED until then.
#
# The token is a long-lived access token created on Sam's Home Assistant
# profile page. It is a SECRET: keep it in this file only.
SCHOOL_HA_URL=http://192.168.20.30:8123
SCHOOL_HA_TOKEN=
# The calendar entity to write to. Discover the real ids with:
#   scripts/calendar-push.sh entities
SCHOOL_HA_CALENDAR_ENTITY=calendar.school
# The internal .lab Caddy certificate is not in the container trust store.
# Set true only when SCHOOL_HA_URL is the https://homeassistant.home.lab URL.
SCHOOL_HA_INSECURE=false
SCHOOL_HA_TIMEOUT=20s