# Minimal bootstrap env.
# Most product settings are configured later in Web App admin:
# Admin -> System -> Settings, Admin -> System -> Tariffs, Admin -> Appearance.
# Full reference: docs/env-vars.md

# Telegram bot token from @BotFather.
# Example: 1234567890:AA...
BOT_TOKEN=your_bot_token_here

# Telegram numeric user IDs allowed to open the admin panel.
# Use commas for several admins, for example: 123456789,987654321
ADMIN_IDS=123456789

# Public HTTPS base URL of the backend webhook server.
# Telegram, payment providers and Remnawave call webhook endpoints under this domain.
# This is usually the backend/API domain, not the Mini App frontend domain.
# Example: https://bot.yourdomain.tld
WEBHOOK_BASE_URL=https://webhooks.yourdomain.tld

# PostgreSQL user created by Docker Compose and used by the backend.
POSTGRES_USER=remnawave_minishop

# PostgreSQL password. Change it before production deploy.
POSTGRES_PASSWORD=change_me

# PostgreSQL database name created by Docker Compose.
POSTGRES_DB=remnawave_minishop

# Enables the Web App and the Web App admin panel.
# Keep True for the first setup. If set to False, the admin UI is unavailable
# until you change it back to True in .env and restart the app.
WEBAPP_ENABLED=True

# Stable secret for Web App sessions.
# Generate with: openssl rand -hex 32
# If empty, sessions are invalidated on every restart.
WEBAPP_SESSION_SECRET=

# Stable Telegram webhook secret_token.
# Generate with: openssl rand -hex 32
# If empty, a new token can be generated on process start.
WEBHOOK_SECRET_TOKEN=

# Public HTTPS URL of the Mini App frontend, with trailing slash.
# This URL is opened by Telegram buttons and BotFather Mini App settings.
# Do not put /api or webhook paths here.
# Example: https://app.yourdomain.tld/
SUBSCRIPTION_MINI_APP_URL=https://app.yourdomain.tld/

# Remnawave panel API URL. Usually the panel domain plus /api.
# Example: https://panel.yourdomain.tld/api
PANEL_API_URL=https://panel.yourdomain.tld/api

# Remnawave API key with permissions to manage users, subscriptions and squads.
# Keep this secret. It can be overridden later in the admin panel if needed.
PANEL_API_KEY=

# Shared secret for validating incoming Remnawave webhooks.
# Create or set this secret in Remnawave Panel, then paste the same value here
# or into Admin -> System -> Settings -> Remnawave Panel.
# In Remnawave Panel, set WEBHOOK_URL to WEBHOOK_BASE_URL + /webhook/panel,
# for example: https://app.example.com/webhook/panel
PANEL_WEBHOOK_SECRET=

# Host port that publishes the backend webhook server from Docker Compose.
# Your reverse proxy should route WEBHOOK_BASE_URL traffic to this port.
WEB_SERVER_PORT=8080

# Host port that publishes the frontend nginx from Docker Compose.
# Your reverse proxy should route SUBSCRIPTION_MINI_APP_URL traffic to this port.
FRONTEND_PORT=8082

# Reverse proxy IPs/CIDRs trusted for X-Forwarded-For.
# Keep loopback and private network ranges so payment provider IP allowlists
# see the original webhook sender behind Docker/LAN/Kubernetes proxies.
TRUSTED_PROXIES=127.0.0.1,::1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,fc00::/7

# ─── Anonymous install telemetry (opt-out) ──────────────────────────────
# Once a day the worker sends a single anonymous "heartbeat" so the project
# maintainer can see how many installs are active and which versions/OSes are
# used. It contains an opaque random install id and coarse facts only:
# version, OS/arch, Python version, language, enabled payment providers and a
# user-count RANGE (e.g. "51-200"). No bot token, domain, user data or any
# personal information is ever sent. Full details: docs/configuration/telemetry.md
#
# Set to False to disable, or toggle it any time in Admin -> System ->
# "Anonymous install analytics" (applies without a restart).
TELEMETRY_ENABLED=True