.env.example

# =============================================================================
# SME Environment Configuration
# =============================================================================
# Copy this file to .env and fill in real values BEFORE running docker-compose.
# NEVER commit .env to version control — it is listed in .gitignore.
#
# Usage:
#   cp .env.example .env
#   # edit .env with your values
#   docker-compose up --build
# =============================================================================

# -----------------------------------------------------------------------------
# Gateway / JWT Security
# REQUIRED — no safe default exists.  Generate with:
#   python -c "import secrets; print(secrets.token_hex(32))"
# -----------------------------------------------------------------------------
SME_GATEWAY_SECRET=CHANGE_ME_generate_a_64_char_hex_string

# -----------------------------------------------------------------------------
# Admin password for the /login endpoint
# REQUIRED — default "admin" is blocked with a CRITICAL log warning.
# -----------------------------------------------------------------------------
SME_ADMIN_PASSWORD=CHANGE_ME_strong_password

# -----------------------------------------------------------------------------
# HSM (Hardware Security Module) signing seed
# REQUIRED — used to anchor evidence integrity signatures.
# -----------------------------------------------------------------------------
SME_HSM_SECRET=CHANGE_ME_hsm_seed_string

# -----------------------------------------------------------------------------
# CORS allowed origins (comma-separated, no trailing slashes)
# Default covers the nginx-served frontend (port 80) and Vite dev server (5173)
# -----------------------------------------------------------------------------
SME_CORS_ORIGINS=http://localhost:80,http://localhost:5173

# -----------------------------------------------------------------------------
# Data directory inside the containers
# Default is /app/data — change only if you remap the volume mount
# -----------------------------------------------------------------------------
SME_DATA_DIR=/app/data

# -----------------------------------------------------------------------------
# PostgreSQL credentials
# These must match the values used when the postgres volume was first created.
# -----------------------------------------------------------------------------
POSTGRES_USER=sme_user
POSTGRES_PASSWORD=CHANGE_ME_postgres_password
POSTGRES_DB=sme_nexus