# ThoughtSync production settings. Copy to `.env` and edit:
#
#   cp .env.example .env
#
# Only POSTGRES_PASSWORD has no default — compose refuses to start without it.
# Everything else here is optional. Anything NOT in this file (site name, signups,
# attachment limits, trash retention, link previews) is configured in the admin
# Settings UI and stored in the database, not here.

# --- required ---------------------------------------------------------------

# Generate one and keep it: changing it later means also changing it inside the
# database, or Postgres will reject the app's connection.
#
#   openssl rand -base64 24 | tr -d '/+=' | head -c 32
#
# Stick to letters and digits. This value goes into a connection URL, so a `@`,
# `/`, `:` or `#` in it will be misparsed as URL structure rather than password.
POSTGRES_PASSWORD=

# --- optional ---------------------------------------------------------------

# Which build to run.
#
#   latest        tracks the `main` branch — the production line (default)
#   dev           tracks the `dev` branch — newer, less settled
#   <commit sha>  pins one exact build; every push publishes one, and this is
#                 the rollback lever when an upgrade misbehaves
#
# NOTE: `main` can sit well behind `dev`. If a feature you expect is missing,
# check which branch it actually landed on before assuming a bug.
#THOUGHTSYNC_TAG=latest

# The host port the app is published on.
#THOUGHTSYNC_PORT=5000

# Which interface to bind. The default (all interfaces) is what lets desktop
# clients on your network reach the server. Behind a reverse proxy, set this to
# 127.0.0.1 so only the proxy can talk to it.
#THOUGHTSYNC_BIND=0.0.0.0

# Database identity. Changing these AFTER the first start does not rename anything
# that already exists — the volume keeps whatever the first run created.
#POSTGRES_USER=thoughtsync
#POSTGRES_DB=thoughtsync

# --- a note on HTTPS --------------------------------------------------------
#
# The app marks its session cookie Secure automatically when a request arrives over
# HTTPS, directly or via a proxy setting X-Forwarded-Proto — no setting needed.
#
# Worth knowing if you use the desktop app: typing a bare hostname there defaults to
# https://, deliberately, so a device token never crosses the wire in cleartext by
# accident. Serving over plain HTTP means typing the `http://` yourself.