DB_HOST=127.0.0.1
# Local Docker (docker compose up -d): 5432
# Remote DB via SSH tunnel (-L 5433:127.0.0.1:5432): 5433
POSTGRES_PORT=5432
POSTGRES_USER=montime
POSTGRES_PASSWORD=montime
POSTGRES_DB=montime
# Dev only: auto-sync schema from entities (do not use true in production)
DB_SYNC=true

JWT_SECRET=change_me_to_a_long_random_secret
OTP_HASH_SECRET=change_me_to_a_long_random_secret
SUPER_ADMIN_MOBILE=09123456789
# Min seconds between OTP requests for the same mobile
OTP_REQUEST_COOLDOWN_SECONDS=60
# Max OTP requests per mobile per rolling hour
OTP_REQUEST_MAX_PER_HOUR=5
# Dev/test only: returns OTP code in API response instead of sending SMS
AUTH_RETURN_OTP=true

# Local folder for business images (served at /uploads/...)
UPLOAD_DIR=uploads

# Comma-separated frontend origins (required in production for browser clients)
# Include both dev ports if calling API directly (without Vite /api proxy)
CORS_ORIGINS=https://montime.ir,https://adm.montime.ir,http://localhost:5173,http://localhost:5174

# SMS — used when AUTH_RETURN_OTP is not true
# Provider: trez (default, smspanel.Trez.ir) | 0098 (legacy)
SMS_PROVIDER=trez
SMS_USERNAME=
SMS_PASSWORD=
# SMS_API_KEY=   # alias for SMS_PASSWORD
# Trez/Raygan sender line (PhoneNumber), e.g. 90002847
SMS_SENDER=
# Trez panel base URL and send path (defaults shown)
# SMS_BASE_URL=http://smspanel.Trez.ir
# SMS_SEND_PATH=/SendMessageWithCode.ashx
# SMS_OTP_TEMPLATE=کد ورود منتایم: {code}
# SMS_TIMEOUT_MS=20000
# --- legacy 0098 only (SMS_PROVIDER=0098) ---
# SMS_TRANSPORT=soap
# SMS_DOMAIN=0098

# Optional: log Server-Timing to PM2 stdout (total;dur=… per request)
# LOG_SERVER_TIMING=true