# Klarbild — configuration
#
# Copy to .env and fill in. Never commit the real file.
# Everything below the first block is optional: Klarbild starts, and the print
# studio works, with nothing but a database, SESSION_SECRET and ENCRYPTION_KEY.

# ─────────────────────────────────────────────────────────────────────────────
# 1. The minimum — this is all a print-only instance needs
# ─────────────────────────────────────────────────────────────────────────────

# The compose files build DATABASE_URL from DB_PASSWORD, so with Docker you set
# only the password here. Running from source, set DATABASE_URL yourself instead.
DB_PASSWORD=CHANGEME
DATABASE_URL=postgres://klarbild:CHANGEME@db:5432/klarbild

# Signs the session cookie. Any long random string.
#   openssl rand -base64 48
SESSION_SECRET=

# Encrypts the credentials Klarbild stores in the database (SMTP password,
# delivery password, API keys). Exactly 32 bytes as 64 hex characters.
#   openssl rand -hex 32
# Losing this means losing those stored credentials — they cannot be recovered,
# only re-entered.
ENCRYPTION_KEY=

# Where finished files live. `fs` writes to a volume and needs nothing else;
# `s3` talks to MinIO or any S3-compatible store (see section 7).
STORAGE_DRIVER=fs
STORAGE_DIR=/data

# Which modules are on. `print` is always on, with or without this line.
#   print            the print studio alone (default)
#   print,ai,share   add image generation and share links
#   all              everything
# See src/lib/modules.ts for the full list: print, ai, delivery, mirror,
# share, mail, telegram.
KLARBILD_MODULES=print

# Interface language: en (default) or de. Visitors can switch with ?lang=,
# which sets a cookie; this is only what they get before they choose.
KLARBILD_LOCALE=en

# Timezone for the timestamp in generated file names.
KLARBILD_TZ=Europe/Berlin

PORT=4321

# How many reverse proxies sit in front of this instance. The rate limiter reads
# the client address that many hops from the right of X-Forwarded-For, so a wrong
# number here lets a client either spoof its address or share someone else's
# limit. One proxy (Caddy, nginx, Traefik, Coolify) is the default.
TRUSTED_PROXIES=1

# ─────────────────────────────────────────────────────────────────────────────
# 2. First start
# ─────────────────────────────────────────────────────────────────────────────
# The first boot creates exactly one administrator. Set these and it uses them;
# leave them empty and Klarbild generates a password and prints it once to the
# server log. There are no other built-in accounts.

ADMIN_USERNAME=admin
ADMIN_PASSWORD=

# ─────────────────────────────────────────────────────────────────────────────
# 3. Public address
# ─────────────────────────────────────────────────────────────────────────────
# Needed for share links and for the Telegram webhook. Behind a reverse proxy
# this is the address the browser sees, not the container port.

PUBLIC_BASE_URL=http://localhost:4321

# ─────────────────────────────────────────────────────────────────────────────
# 4. Module: ai — image generation
# ─────────────────────────────────────────────────────────────────────────────
# Klarbild calls image models through OpenRouter. This costs money per image.
# The key can also be entered in the admin area; the database value wins.

OPENROUTER_API_KEY=

# ─────────────────────────────────────────────────────────────────────────────
# 5. Module: mail
# ─────────────────────────────────────────────────────────────────────────────
# Klarbild sends through your own mailbox rather than a delivery service, so
# SPF and DKIM are already right and no third party reads along. These values
# apply until something is entered under Admin → Email, which then takes over.

SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=

# ─────────────────────────────────────────────────────────────────────────────
# 6. Module: delivery — push finished files to a server you already have
# ─────────────────────────────────────────────────────────────────────────────
# The target itself (host, protocol, user, password) is configured in the admin
# area, because the password belongs in the encrypted settings row, not here.
# This is only the folder used when nothing more specific is set.

DELIVERY_DEFAULT_FOLDER=klarbild

# ─────────────────────────────────────────────────────────────────────────────
# 7. Module: telegram
# ─────────────────────────────────────────────────────────────────────────────
# A bot token from @BotFather. The webhook registers itself after deploy and
# needs PUBLIC_BASE_URL to be reachable from the internet.

TELEGRAM_BOT_TOKEN=

# ─────────────────────────────────────────────────────────────────────────────
# 8. S3 / MinIO — only when STORAGE_DRIVER=s3
# ─────────────────────────────────────────────────────────────────────────────

S3_ENDPOINT=http://minio:9000
S3_REGION=us-east-1
S3_BUCKET=klarbild
S3_ACCESS_KEY=
S3_SECRET_KEY=
S3_FORCE_PATH_STYLE=true

# A webhook that fires when a job finishes — for n8n and the like — is set in the
# admin area rather than here, because it is a per-instance setting rather than a
# secret.