# Production environment example — copy to .env.prod and edit:
#   cp .env.prod.example .env.prod

# Must match the URL you open in the browser (scheme + host + port).
# HTTP direct (Docker port 3009):
CLIENT_ORIGIN=http://localhost:3009
# HTTPS behind reverse proxy:
# CLIENT_ORIGIN=https://casegambling.example.com

# Extra allowed origins (comma-separated), optional
# CORS_ORIGINS=http://192.168.1.10:3009

# Session secret — use a long random string in real prod
SESSION_SECRET=change-me-to-a-long-random-secret

# Admin panel login (required — created/updated on every container start)
ADMIN_USERNAME=admin
ADMIN_PASSWORD=change-me-strong-password

# Starting balances for new accounts (credits in cents, osu as units)
# In production, keep STARTING_OSU low/0 — osu is the real-money currency.
STARTING_BALANCE=10000
STARTING_OSU=25

# Payments (osu top-ups)
# mock = instant confirm for local/dev (default)
# stripe = Stripe Checkout + webhook (requires keys below)
PAYMENTS_PROVIDER=stripe
STRIPE_SECRET_KEY=sk_test_...
STRIPE_PUBLISHABLE_KEY=pk_test_...
# From Stripe CLI (`stripe listen`) or Dashboard → Webhooks → Signing secret
STRIPE_WEBHOOK_SECRET=whsec_...

# Jackpot
JACKPOT_ROUND_SECONDS=30
JACKPOT_MAX_ITEMS=3

# Cookie Secure:
#   false / auto  → OK for plain HTTP (:3009)
#   true          → only with HTTPS (otherwise login cookie is dropped by the browser)
COOKIE_SECURE=false

# Trust X-Forwarded-* (only behind nginx/caddy/traefik)
TRUST_PROXY=false

# Host port mapped in docker-compose
HOST_PORT=3009