# 🚀 Customer Portal - Production Environment
# Copy this file to .env for production deployment
# This configuration is optimized for production with security and performance

# =============================================================================
# 🌐 APPLICATION CONFIGURATION
# =============================================================================
NODE_ENV=production
APP_NAME=customer-portal-bff
BFF_PORT=4000
APP_BASE_URL=https://portal.yourdomain.com

# =============================================================================
# 🔐 SECURITY CONFIGURATION (Production)
# =============================================================================
# CRITICAL: Generate with: openssl rand -base64 32
JWT_SECRET=GENERATE_SECURE_JWT_SECRET_HERE_MINIMUM_32_CHARS
JWT_EXPIRES_IN=7d

# Password Hashing (High rounds for security)
BCRYPT_ROUNDS=12

# =============================================================================
# 🗄️ DATABASE & CACHE (Production)
# =============================================================================
# Docker internal networking (container names as hostnames)
DATABASE_URL=postgresql://portal:YOUR_SECURE_DB_PASSWORD@database:5432/portal_prod?schema=public
REDIS_URL=redis://cache:6379

# =============================================================================
# 🌍 NETWORK & CORS (Production)
# =============================================================================
# Your production domain
CORS_ORIGIN=https://yourdomain.com
TRUST_PROXY=true

# =============================================================================
# 🚦 RATE LIMITING (Production)
# =============================================================================
# Strict rate limiting for production
RATE_LIMIT_TTL=60000
RATE_LIMIT_LIMIT=100
AUTH_RATE_LIMIT_TTL=900000
AUTH_RATE_LIMIT_LIMIT=3

# =============================================================================
# 🏢 EXTERNAL INTEGRATIONS (Production)
# =============================================================================
# WHMCS Integration (Production Environment)
WHMCS_BASE_URL=https://your-whmcs-domain.com
WHMCS_API_IDENTIFIER=your_production_identifier
WHMCS_API_SECRET=your_production_secret
WHMCS_WEBHOOK_SECRET=your_whmcs_webhook_secret

# Salesforce Integration (Production Environment)
SF_LOGIN_URL=https://login.salesforce.com
SF_CLIENT_ID=your_production_client_id
SF_PRIVATE_KEY_PATH=/app/secrets/sf-prod.key
SF_USERNAME=production@yourcompany.com
SF_WEBHOOK_SECRET=your_salesforce_webhook_secret

# =============================================================================
# 📊 LOGGING (Production)
# =============================================================================
# Production logging level
LOG_LEVEL=info

# =============================================================================
# 🎯 FRONTEND CONFIGURATION (Production)
# =============================================================================
# NEXT_PUBLIC_ variables are exposed to browser
NEXT_PUBLIC_APP_NAME=Customer Portal
NEXT_PUBLIC_APP_VERSION=1.0.0
NEXT_PUBLIC_API_BASE=https://yourdomain.com
NEXT_PUBLIC_ENABLE_DEVTOOLS=false

# =============================================================================
# 🎛️ PRODUCTION OPTIONS
# =============================================================================
# Node.js options for production
NODE_OPTIONS=--max-old-space-size=2048

# =============================================================================
# ✉️ EMAIL (SendGrid) - Production
# =============================================================================
# Create and store securely (e.g., KMS/Secrets Manager)
SENDGRID_API_KEY=
EMAIL_FROM=no-reply@yourdomain.com
EMAIL_FROM_NAME=Assist Solutions
EMAIL_ENABLED=true
EMAIL_USE_QUEUE=true
SENDGRID_SANDBOX=false
# Optional: Dynamic Template IDs (recommended)
EMAIL_TEMPLATE_RESET=
EMAIL_TEMPLATE_WELCOME=

# =============================================================================
# 🔒 PRODUCTION SECURITY CHECKLIST
# =============================================================================
# ✅ Replace ALL default/demo values with real credentials
# ✅ Use strong, unique passwords and secrets (minimum 32 characters for JWT)
# ✅ Ensure SF_PRIVATE_KEY_PATH points to actual key file
# ✅ Set correct CORS_ORIGIN for your domain
# ✅ Use HTTPS URLs for all external services
# ✅ Verify DATABASE_URL password matches docker-compose.yml
# ✅ Test all integrations before going live
# ✅ Configure webhook secrets for security
# ✅ Set appropriate rate limiting values
# ✅ Enable trust proxy if behind reverse proxy

# =============================================================================
# 🚀 QUICK START (Production)
# =============================================================================
# 1. Copy this template: cp .env.production.example .env
# 2. Edit .env with your production values (REQUIRED!)
# 3. Deploy: pnpm prod:deploy
# 4. Access: https://yourdomain.com