# API Server configuration
# Copy to .env and adjust. The server also reads plain environment variables.
# Never commit the real .env file.

# Address the API Server listens on. A bare port (8080) is accepted too.
API_ADDR=:8080

# PocketBase base URL (no trailing slash). The API Server is the only thing that
# talks to PocketBase; it proxies /api/auth/* to this address, which is never
# exposed to clients. Editable at runtime from the panel (PocketBase section),
# which writes the change back into this file.
POCKETBASE_URL=http://10.2.1.10:8027

# PocketBase superuser service account. Every privileged flow runs through it:
# user/organization management and all car-domain database access. Leave unset
# and the server still starts — a superadmin can log in to the panel and
# configure it there; management endpoints return 503 until then.
POCKETBASE_ADMIN_EMAIL=
POCKETBASE_ADMIN_PASSWORD=

# This server's display name, reported by GET /api/health so a client pointed at
# several DriverVaults can tell them apart (the Web App's server switcher labels
# an added server with it). Editable at runtime from the panel (API Server
# section), which writes the change back into this file. Max 64 characters;
# unset falls back to "DriverVault API Server".
SERVER_NAME=

# CORS allowed origins for browser clients (comma separated, or * for any).
# Native mobile apps are not subject to CORS. Editable at runtime from the panel
# (Web App section), which writes the change back into this file.
CORS_ALLOW_ORIGINS=http://localhost:8090

# Web App address, probed by GET /api/status and shown on the panel. Editable at
# runtime from the panel (Web App section).
WEBAPP_URL=http://localhost:8090

# PocketBase auth collection holding app users (default: users).
AUTH_USERS_COLLECTION=users

# --- EV charging control (Anker Solix, OCPP) ---------------------------------
# Only relevant when a charger is set to own/proxy control mode. The charger
# dials in to /ocpp/{serial} on this server, authenticating with OCPP Basic auth
# (serial + per-charger control token). A plaintext ws:// would carry that token
# in the clear, so connections that did not arrive over TLS are rejected —
# disable only for local dev on a trusted network.
OCPP_REQUIRE_TLS=true

# The canonical ws(s):// base an operator points the charger at. Set this when
# the server sits behind a reverse proxy, where deriving the URL from request
# headers is unreliable. Empty = derive it.
OCPP_PUBLIC_URL=

# --- Legacy names -----------------------------------------------------------
# PB_URL, PB_ADMIN_EMAIL, PB_ADMIN_PASSWORD, PORT and CORS_ORIGINS are still
# honoured for older deployments; the POCKETBASE_*/API_ADDR names above win when
# both are set. AUTH_SECRET is gone — the server no longer mints its own JWTs.
