# Copy to .env for local overrides (never commit .env).
# python-decouple loads .env automatically when present.

SECRET_KEY=change-me
DEBUG=true
DATABASE_URL=sqlite:///db.sqlite3
DEFAULT_TENANT_ID=tenant:coulomb

# --- NetKingdom OIDC (KeyCape) ---
# Offline shell: leave OIDC_ENABLED=false and use /auth/dev-login/
OIDC_ENABLED=false
OIDC_ISSUER=https://kc.coulomb.social
OIDC_CLIENT_ID=coulomb-social
OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
# Public client — no secret:
# OIDC_CLIENT_SECRET=
OIDC_SCOPES=openid profile email groups
# Ordinary sign-in is AAL1; sensitive actions request this ACR explicitly.
OIDC_STEP_UP_ACR=aal2
# Enable the landing-page registration link when public registration is deployed.
# NETKINGDOM_REGISTRATION_URL=https://users.coulomb.social/register?client_id=coulomb-social

USER_ENGINE_APPLICATION_ID=coulomb-social
USER_ENGINE_EXPECTED_AUDIENCE=user-engine-portal
# Live user-engine (both required for HTTP mode):
# USER_ENGINE_BASE_URL=https://users.92-205-62-239.nip.io
# USER_ENGINE_PROXY_SECRET=   # from OpenBao / kubectl user-engine-runtime — never commit
# FLEX_AUTH_BASE_URL=

# --- Space content (Forgejo / ADR-0002) ---
# FORGEJO_BASE_URL=https://forgejo.coulomb.social
# FORGEJO_TOKEN=                 # optional; private repos only — never commit
# FORGEJO_WEBHOOK_SECRET=        # optional push webhook — never commit
# SPACE_CONTENT_FIXTURE_ROOT=    # optional offline fixture root for tests