# Copy to /etc/tiku-saas/api.env and chmod 600.
# This file is read by systemd. Do not commit the real file.

NODE_ENV=production
PORT=8787

DATABASE_URL=postgresql://tiku_app:replace-with-password@127.0.0.1:5432/postgres
DEFAULT_TENANT_SLUG=master
CORS_ORIGIN=https://app.tjszsb.com,https://admin.tjszsb.com,https://console.tjszsb.com

ALLOW_LEGACY_AUTH_HEADERS=false
ALLOW_PLATFORM_ADMIN_KEY=false

SUPABASE_URL=https://supabase.tjszsb.com
AUTH_JWT_ISSUER=https://supabase.tjszsb.com/auth/v1
AUTH_JWT_JWKS_URL=https://supabase.tjszsb.com/auth/v1/.well-known/jwks.json
AUTH_SESSION_SECRET=replace-with-strong-random-session-secret
AUTH_CODE_PEPPER=replace-with-strong-random-code-pepper
PLATFORM_ADMIN_API_KEY=replace-with-strong-random-platform-admin-key

AUTH_SMS_PROVIDER=aliyun
ALIYUN_SMS_ACCESS_KEY_ID=replace-with-access-key-id
ALIYUN_SMS_ACCESS_KEY_SECRET=replace-with-access-key-secret
ALIYUN_SMS_SIGN_NAME=replace-with-sms-sign
ALIYUN_SMS_TEMPLATE_LOGIN=replace-with-template-code

WECHAT_MINIAPP_APP_ID=replace-with-miniapp-app-id
WECHAT_MINIAPP_APP_SECRET=replace-with-miniapp-app-secret
WECHAT_WEB_APP_ID=replace-with-web-app-id
WECHAT_WEB_APP_SECRET=replace-with-web-app-secret
QQ_CONNECT_APP_ID=replace-with-qq-app-id
QQ_CONNECT_APP_KEY=replace-with-qq-app-key

PAYMENT_WECHAT_ENABLED=true
WECHAT_PAY_MCH_ID=replace-with-merchant-id
WECHAT_PAY_APP_ID=replace-with-pay-app-id
WECHAT_PAY_API_V3_KEY=replace-with-api-v3-key
WECHAT_PAY_PRIVATE_KEY=replace-with-private-key-path-or-kms-id
WECHAT_PAY_NOTIFY_URL=https://api.tjszsb.com/api/commerce/webhooks/wechat-pay

PAYMENT_ALIPAY_ENABLED=true
ALIPAY_APP_ID=replace-with-alipay-app-id
ALIPAY_APP_PRIVATE_KEY=replace-with-private-key-path-or-kms-id
ALIPAY_PUBLIC_KEY=replace-with-alipay-public-key
ALIPAY_NOTIFY_URL=https://api.tjszsb.com/api/commerce/webhooks/alipay

STORAGE_DEFAULT_PROVIDER=aliyun_oss
ALIYUN_OSS_REGION=oss-cn-beijing
ALIYUN_OSS_ENDPOINT=https://oss-cn-beijing.aliyuncs.com
ALIYUN_OSS_BUCKET=replace-with-bucket
ALIYUN_OSS_ACCESS_KEY_ID=replace-with-access-key-id
ALIYUN_OSS_ACCESS_KEY_SECRET=replace-with-access-key-secret
ASSET_SIGNING_SECRET=replace-with-strong-random-asset-secret

WORKER_ASSET_SECURITY_SCANNER=metadata_rules,http
WORKER_ASSET_SECURITY_SCAN_FAIL_OPEN=false
ASSET_SECURITY_SCAN_ENDPOINT=https://replace-with-security-scanner.example.com/scan
ASSET_SECURITY_SCAN_TOKEN=replace-with-scanner-token