# DriverVault all-in-one — production config.
# Copy to .env and fill in, then:
#   docker compose -f docker-compose.prod.yml pull
#   docker compose -f docker-compose.prod.yml up -d

# --- Registry image ----------------------------------------------------------
AIO_IMAGE=10.2.1.10:5500/admin/drivervault-aio:latest

# --- PocketBase superuser (required) -----------------------------------------
# Created/updated on first boot. The API Server uses these to manage the database.
PB_ADMIN_EMAIL=admin@example.com
PB_ADMIN_PASSWORD=change-me-long-password

# --- DriverVault super-admin (app login) -------------------------------------
# The first application user, created by the API Server on boot with role
# "superadmin" if no user with this email exists yet. Leave blank to skip.
DRIVERVAULT_SUPERADMIN_EMAIL=owner@example.com
DRIVERVAULT_SUPERADMIN_PASSWORD=change-me-long-password
DRIVERVAULT_SUPERADMIN_NAME=Administrator

# Schema creation/reconcile on boot. Leave this true: a release can add
# collections or fields the server needs, and a stack that skips the bootstrap
# never gets them. (The API Server creates app_settings, which holds the plugin
# settings, on demand — but only that one.) Set false only for a database you
# know already matches the release.
PB_BOOTSTRAP=true

# Allowed CORS origin(s) — match your public web URL / WEB_PORT.
CORS_ALLOW_ORIGINS=http://localhost:8090

# --- EV charging control (Anker Solix, OCPP) ---------------------------------
# Only relevant when a charger is set to own/proxy control mode. The charger
# dials in to /ocpp/{serial} on the API Server port, carrying its control token
# in an OCPP Basic-auth header — which a plaintext ws:// would expose, so
# non-TLS connections are rejected by default. This image serves plain HTTP, so
# terminate TLS in a reverse proxy in front of it and set OCPP_PUBLIC_URL to the
# public wss:// base the charger should be pointed at. Turning the check off is
# for trusted networks only.
OCPP_REQUIRE_TLS=true
OCPP_PUBLIC_URL=

# --- Host port mappings (optional; defaults shown) --------------------------
WEB_PORT=8090
PB_PORT=8070
API_PORT=8080

# --- Settings the API Server panel can also change ---------------------------
# The panel's Settings screens apply these immediately, but only for the life of
# the container — the value below is re-applied on every restart and wins. Set it
# here to make a change permanent. (POCKETBASE_URL is fixed to this container's
# own PocketBase and is not meant to be repointed.)
#   WEBAPP_URL          the Web App address the panel status page probes; nginx
#                       serves it on port 80 inside this container.
#   CORS_ALLOW_ORIGINS  browser origins allowed to call the API Server directly.
# WEBAPP_URL=http://127.0.0.1:80

# --- Storage -----------------------------------------------------------------
# One Docker-managed named volume by default. Set it to an absolute host path
# for a bind mount, e.g. PB_DATA=/srv/drivervault/pb_data.
# PB_DATA — the PocketBase database and uploads. It is the only volume in the
# image: the API Server keeps no state on disk, so everything it owns (plugin
# settings included) is backed up by backing up this one path.
PB_DATA=pb_data