NODE_ENV=production
APP_PORT=3000
PORT=3000
TZ=Asia/Ho_Chi_Minh
APP_TIME_ZONE=Asia/Ho_Chi_Minh

# Database: never commit real credentials.
DB_SERVER=sql-server.internal
DB_USER=accmanager_app
DB_PASSWORD=replace-with-a-strong-database-password
DB_NAME=AccManager
DB_ENCRYPT=true
DB_TRUST_CERTIFICATE=false
DB_CONNECT_TIMEOUT=30000

# Generate a separate random value of at least 32 bytes and keep it stable.
# Changing this value without a key-rotation migration will make stored
# application credentials unreadable.
DATA_ENCRYPTION_SECRET=replace-with-at-least-32-random-bytes
BCRYPT_ROUNDS=12

# Public HTTPS origin used by email links, CORS and secure cookies.
APP_BASE_URL=https://accmanager.example.internal
CORS_ALLOWED_ORIGINS=https://accmanager.example.internal
COOKIE_SECURE=true
TRUST_PROXY_HOPS=1
SESSION_TTL_HOURS=12
REMEMBER_SESSION_TTL_DAYS=14
ALLOW_SELF_REGISTRATION=false

# Only needed once when bootstrapping an empty database. Remove the password
# from the environment after the first administrator has been created.
INITIAL_ADMIN_USERNAME=admin
INITIAL_ADMIN_PASSWORD=
INITIAL_ADMIN_EMAIL=admin@example.internal

SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_REQUIRE_TLS=true
SMTP_USER=
SMTP_PASS=
SMTP_FROM=
EMAIL_VERIFY_TOKEN_TTL_MINUTES=30
PASSWORD_RESET_TOKEN_TTL_MINUTES=30