# GTI Fiscal Hub — production environment (copy to .env, never commit .env)
GTI_FISCAL_VERSION=1.2.4

# REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
POSTGRES_PASSWORD=

# REQUIRED. Public HTTPS URL that Agents use (TLS terminates in the reverse proxy in front of the Hub).
BASE_URL=https://fiscal.example.gti

# Interface the Hub listens on. Keep 127.0.0.1 when a reverse proxy runs on the same host; use the LAN IP only behind a firewall.
# Docker-published ports bypass UFW: restrict the source in the DOCKER-USER chain (see docs/PILOT_DEPLOYMENT.md).
HUB_BIND=127.0.0.1
HUB_PORT=8000

# IP(s) of the reverse proxy allowed to set X-Forwarded-For/-Proto (comma-separated). 127.0.0.1 = same host.
FORWARDED_ALLOW_IPS=127.0.0.1
# 1 once HTTPS terminates in front of the Hub (session/CSRF cookies become Secure).
WEB_COOKIE_SECURE=0

# SSO from GTI Gerenciador (docs/PILOT_DEPLOYMENT.md, "Human access"). Needs HTTPS (WEB_COOKIE_SECURE=1).
# PUBLIC key only (raw Ed25519, base64url) — the private key lives only in the panel.
SSO_GERENCIADOR_CHAVE_PUBLICA=
SSO_START_URL=https://gtigerenciador.example.gti/sso/fiscal
# Collaborator session lifetime; afterwards they are signed in again transparently.
FEDERATED_SESSION_SECONDS=3600

LOG_LEVEL=INFO
AGENT_ONLINE_THRESHOLD_SECONDS=120

# Agent distribution (docs/PILOT_DEPLOYMENT.md, "Agent distribution"). Defaults
# are safe; override only if the pilot needs a longer/shorter window.
# AGENT_DOWNLOAD_LINK_TTL_SECONDS=1800
# AGENT_DOWNLOAD_MAX_USES_DEFAULT=1
# AGENT_ENROLLMENT_TTL_SECONDS=86400

# Client mirror from GTI Gerenciador (docs/PILOT_DEPLOYMENT.md, "Client integration").
# GTI Gerenciador is the single source of truth for clients — the Fiscal Hub never
# gets MySQL credentials. Both empty = sync disabled (no client selector data).
GERENCIADOR_INTERNAL_URL=https://gtigerenciador.example.gti/internal/fiscal/clients
# Dedicated bearer token, shared only with the panel's FISCAL_INTERNAL_API_TOKEN —
# never SESSION_SECRET, the SSO key, an admin password or an Agent token.
FISCAL_INTERNAL_API_TOKEN=

# Directory (host) where pg_dump backups are written by backup.sh
BACKUP_DIR=./backups
# Max whole-database jobs (INITIAL_SYNC / REPROCESS_ALL) running at once across all Agents; others queue as PENDING. <=0 disables.
HEAVY_JOB_CONCURRENCY_LIMIT=3