# --- Application Security ---
# Set to a long, random string in production (e.g. 50+ chars)
SECRET_KEY="django-insecure-replace-this-in-production"

# Set to "false" in production for security and performance
DEBUG=true

# Custom URL for the Django Admin interface (e.g., my-secret-admin/)
ADMIN_URL="admin"

# --- Hosting & Networking ---
# The primary domain where your app is hosted (e.g., holy.narl.io)
ALLOWED_HOSTS=localhost,127.0.0.1,backend,holy.narl.io

# CSRF protection: Comma-separated list of trusted origins (MUST start with https:// in production)
CSRF_TRUSTED_ORIGINS=https://holy.narl.io

# CORS protection: Comma-separated list of allowed origins
CORS_ALLOWED_ORIGINS=https://holy.narl.io

# --- SMTP Configuration (Required for Email Verification) ---
# For development, if EMAIL_HOST is empty, emails are printed to the console.
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=465
EMAIL_USE_SSL=true
EMAIL_HOST_USER="your-email@gmail.com"
EMAIL_HOST_PASSWORD="your-app-specific-password"

# --- Frontend Configuration ---
# The base URL of the backend API (MUST end with /api/)
VITE_API_URL=https://holy.narl.io/api/
VITE_ALLOWED_HOSTS=localhost,holy.narl.io

# --- Impressum / Contact Details (Required for German Law § 5 TMG) ---
VITE_IMPRESSUM_NAME="Your First and Last Name"
VITE_IMPRESSUM_STREET="Street Name and House Number"
VITE_IMPRESSUM_CITY="Postal Code and City"
VITE_IMPRESSUM_EMAIL="your-public-contact@email.com"
VITE_IMPRESSUM_PHONE="+49 123 456789"