# --- Application Security ---
# Set to a long, random string in production
SECRET_KEY=django-insecure-replace-this-in-production

# Set to "false" in production for security and performance
DEBUG=true

# Custom URL for the Django Admin interface (e.g., secret-admin/)
ADMIN_URL=admin/

# --- Hosting & Networking ---
# The primary domain where your app is hosted (e.g., holy.narl.io)
# Comma-separated list for backend to allow requests
ALLOWED_HOSTS=localhost,127.0.0.1,backend

# CSRF protection: Comma-separated list of trusted origins (must start with http:// or https://)
CSRF_TRUSTED_ORIGINS=http://localhost:5173

# CORS protection: Comma-separated list of allowed origins (must match your frontend domain)
CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173

# --- SMTP Configuration (Required for Email Verification) ---
# For development, if EMAIL_HOST is empty, emails are printed to the console.
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_USE_TLS=true
EMAIL_HOST_USER=your-email@gmail.com
EMAIL_HOST_PASSWORD=your-app-specific-password

# --- Frontend Configuration ---
# The base URL of the backend API (e.g., https://holy.narl.io/api/)
VITE_API_URL=http://localhost:8000/api/
VITE_ALLOWED_HOSTS=localhost