# Copy this file to .env and replace every example value.
SECRET_KEY=replace-with-a-long-random-secret
DATABASE_URL=mysql+pymysql://root:@127.0.0.1/communications_suite?charset=utf8mb4
HOST=127.0.0.1
PORT=8000
FLASK_DEBUG=0
AUTO_CREATE_TABLES=1
COOKIE_SECURE=0
MAX_UPLOAD_MB=20
STORAGE_DIR=./storage
BOOTSTRAP_ADMIN_NAME=Super Admin
BOOTSTRAP_ADMIN_EMAIL=admin@example.com
BOOTSTRAP_ADMIN_PASSWORD=replace-with-a-password-of-at-least-12-characters
ALLOW_INSECURE_PROVIDER_HTTP=0

# Optional AI (configure in Super Admin > AI Administration; DB values override these)
# Never commit real API keys.
# Production: set COOKIE_SECURE=1 behind HTTPS.
# Set ALLOW_INSECURE_PROVIDER_HTTP=0 in production.

# Maximum combined campaign attachment size in MB
CAMPAIGN_ATTACHMENT_MAX_MB=15
# Additional upload limits (per campaign/template/reminder or API request)
TEMPLATE_ATTACHMENT_MAX_MB=15
REMINDER_ATTACHMENT_MAX_MB=15
TEMPLATE_EML_MAX_MB=15

# Canonical public URL used by background workers for absolute links.
# Local development: http://localhost:8000/ . Production: your real HTTPS domain.
APP_BASE_URL=http://localhost:8000/
SERVER_NAME=localhost:8000
APPLICATION_ROOT=/
PREFERRED_URL_SCHEME=http

# Incoming inbox polling. The legacy IMAP connection and all additional email agents are supported.
INBOX_SYNC_ENABLED=1
INBOX_SYNC_INTERVAL_SECONDS=120
INBOX_AUTO_REFRESH_SECONDS=30

# Link engagement tracking. Set APP_BASE_URL to the URL recipients can actually reach.
# Open tracking is approximate because email clients can block or proxy images.
TRACKING_ENABLED=1
TRACKING_IP_HASH_SALT=replace-with-a-separate-random-tracking-salt

# Scheduler modes (all optional; existing CLI worker remains supported).
# External cron URL: /cron (GET or POST) and /internal/scheduler/run (GET or POST).
# Disabled by default. Set a unique random token of at least 32 characters before enabling.
# For a hosting cron service, use: https://your-domain.example/cron?token=YOUR_LONG_RANDOM_TOKEN
# Prefer an X-Scheduler-Token header when your cron provider supports request headers.
SCHEDULER_URL_ENABLED=0
SCHEDULER_URL_TOKEN=
SCHEDULER_INTERVAL_SECONDS=30
SCHEDULER_LEASE_SECONDS=900

# Queue page status polling; this refreshes the page data, not the worker itself.
QUEUE_AUTO_REFRESH_ENABLED=1
QUEUE_AUTO_REFRESH_SECONDS=15

# Optional browser-driven scheduler tick. Unreliable if browser closes or sleeps; use only for local/single-instance setups.
BROWSER_SCHEDULER_ENABLED=0

# Built-in scheduler for direct `python app.py` / frozen EXE only; Flask CLI/Wsgi should use a separate scheduled command.
ENABLE_BACKGROUND_SCHEDULER=1

# Queue recovery: stale processing jobs become "unknown", never auto-requeued,
# because the provider may have accepted a message before a worker crashed.
# Reconcile the provider outcome before manually retrying an unknown message.
PROCESSING_STALE_AFTER_SECONDS=900

# Incoming email attachment handling: auto, manual, or none (Super Admin setting overrides this default)
INBOX_ATTACHMENT_POLICY=manual
INBOX_ATTACHMENT_MAX_MB=20

# Tenant webhook delivery outbox
WEBHOOK_TIMEOUT_SECONDS=10
WEBHOOK_MAX_ATTEMPTS=10
# Webhook targets must be public HTTPS endpoints; callbacks use HMAC-SHA256 signatures.

# Enable only when the entire public site is served over HTTPS.
HSTS_ENABLED=0
