# ══════════════════════════════════════════════════════════════
#  BACKEND  —  https://bk.darikbet.com
#  cPanel application root: eta-backend
#
#  Upload as  /home/darikbet/eta-backend/.env
#  (or paste each line into Setup Node.js App → Environment variables)
#
#  This tier owns the database, the login sessions and the uploaded photos.
#  Its /api is not open to the internet: only a caller presenting
#  INTERNAL_API_KEY gets past it, and everyone else gets a flat 404.
# ══════════════════════════════════════════════════════════════
NODE_ENV=production

# ─── PostgreSQL ────────────────────────────────────────────────
# cPanel prefixes the database and the role with the account name, so these are
# the prefixed names — not the bare "eta"/"postgres" used in development.
DB_HOST=localhost
DB_PORT=5432
DB_USER=darikbet_hizkiyas
DB_PASSWORD=Kstarmoney1!
DB_NAME=darikbet_eta
DB_SSL=false

# Connections THIS process may hold. Passenger runs several processes and each
# opens its own pool, so the total load on PostgreSQL is this number times the
# process count. Shared hosting allows very few connections in total — raise
# this only if /healthz reports requests waiting for a slot.
DB_POOL_MAX=5
DB_IDLE_TIMEOUT_MS=10000

# ─── Who is allowed to call this API ───────────────────────────
# MUST be byte-for-byte identical to INTERNAL_API_KEY in deploy/frontend.env.
INTERNAL_API_KEY=ebb81503a9a9ef879ef516bc9af07b27cf0ce50e657d5b0896620e1d7c67a0d6

# The panel's origin. Logged at boot; not used for CORS, because no browser
# ever calls this API directly.
PUBLIC_URL=https://adminkstar.darikbet.com

# ─── Cookies ───────────────────────────────────────────────────
# Leave COOKIE_DOMAIN unset. The session cookie reaches the browser through the
# frontend's own response, so it is scoped to adminkstar.darikbet.com alone —
# tighter than sharing it across the parent domain, and nothing needs it here.
COOKIE_DOMAIN=
COOKIE_SECURE=true
COOKIE_SAMESITE=lax

# ─── Session ───────────────────────────────────────────────────
SESSION_SECRET=5417331e2af77ae34206d97dd9dd9db0cbe4d68c57b85c5b6afbd5ecedcddcbaf677a196b73416197ccff59cfaa71262
SESSION_MAX_AGE_MS=7200000

# ─── Uploads ───────────────────────────────────────────────────
# Kept outside the app root so a redeploy never wipes it. Only this tier reads
# or writes it; the panel renders the photos as https://bk.darikbet.com/uploads/...
UPLOAD_DIR=/home/darikbet/eta-uploads
MAX_UPLOAD_BYTES=5242880

# ─── Auth ──────────────────────────────────────────────────────
AUTO_UPGRADE_PASSWORD_HASH=false
BCRYPT_ROUNDS=12
LOGIN_MAX_ATTEMPTS=5
LOGIN_WINDOW_MS=900000

# Apache/Passenger hops in front of the app. 1 on cPanel.
TRUST_PROXY=1

# Do NOT set PORT — Passenger assigns it.
