# Copy this file to /opt/tiku-saas/shared/deploy.env on the server.
# Do not commit the real deploy.env.

APP_NAME=tiku-supabase
REPO_URL=https://git.gongxue100.com/chenhaogxjy/tiku-supabase.git
BRANCH=main
DEPLOY_ROOT=/opt/tiku-saas
KEEP_RELEASES=5

# Private Gitea repository access.
# Prefer a short-lived token with read-only repository scope.
# Do not put the token in REPO_URL.
# GIT_USERNAME=chenhaogxjy
# GITEA_TOKEN=replace-with-rotated-readonly-token

# Install/build/check gates.
NPM_INSTALL_COMMAND="npm ci --workspaces --include-workspace-root --include=dev"
# Audit metadata must come from an npm registry that implements the audit API.
# Keep this on the official registry even if package downloads use a mirror.
NPM_AUDIT_REGISTRY=https://registry.npmjs.org/
RUN_CHECKS=true
CHECK_COMMANDS="npm run check:api
npm run check:worker
npm run check:taro"
RUN_API_BUILD=true
RUN_WORKER_BUILD=true
RUN_TARO_H5_BUILD=true
RUN_SECURITY_REPO_SCAN=true
RUN_RUNTIME_AUDIT=true
# This audit covers dependencies that ship in the Taro H5/miniapp bundle.
RUN_TARO_SUPPLY_CHAIN_AUDIT=true

# Production gates.
# auto runs readiness:production when NODE_ENV=production.
NODE_ENV=production
RUN_PRODUCTION_READINESS=auto
RUN_DB_READINESS=true

# Database migrations are intentionally opt-in. Enable only after backup and rehearsal.
# When enabled, the deploy script runs readiness:production:db again after db push
# and before launch:gate; production refuses to disable that post-migration check.
RUN_DB_MIGRATIONS=false
# Do not assign this in the file; inject DATABASE_MIGRATION_URL for the standard
# migration role from a secret manager immediately before deployment.
DB_MIGRATION_COMMAND='supabase db push --db-url "$DATABASE_MIGRATION_URL"'

# H5 runtime configs stay in shared/ and are symlinked into each release dist.
# Production deployment blocks until these files exist and pass strict validation.
STRICT_H5_RUNTIME_CONFIG=true
RUN_H5_SMOKE=true
H5_STUDENT_RUNTIME_CONFIG=/opt/tiku-saas/shared/h5-student.runtime-config.json
H5_TENANT_RUNTIME_CONFIG=/opt/tiku-saas/shared/h5-tenant-admin.runtime-config.json
H5_PLATFORM_RUNTIME_CONFIG=/opt/tiku-saas/shared/h5-platform-admin.runtime-config.json

# Nginx serves /srv/tiku-saas/www/{student,tenant-admin,platform-admin}.
# The deployer stages versioned Web roots beside this path and atomically switches
# /srv/tiku-saas/www after all candidate checks pass.
WWW_ROOT=/srv/tiku-saas/www
WWW_RELEASES_DIR=/srv/tiku-saas/www-releases

# The bundled systemd units run from /opt/tiku-saas/repo. The deployer explicitly
# synchronizes the selected current release into this runtime directory before restart.
SERVICE_REPO_DIR=/opt/tiku-saas/repo
SYNC_SERVICE_REPO=true

# Real production evidence is generated out-of-band and stays in shared/, never in Git.
RUN_LAUNCH_GATE=true
PRODUCTION_LAUNCH_EVIDENCE=/opt/tiku-saas/shared/production-launch-evidence.json

# Production defaults are fail-closed: a real restart strategy and healthcheck are required.
SERVICE_MODE=systemd
SYSTEMD_UNITS="tiku-api.service tiku-workers.target"

# systemd example:
# SERVICE_MODE=systemd
# SYSTEMD_UNITS="tiku-api.service tiku-workers.target"

# pm2 example:
# SERVICE_MODE=pm2
# PM2_ECOSYSTEM=/opt/tiku-saas/current/ecosystem.config.cjs
# PM2_PROCESS_NAMES="tiku-api tiku-worker"

# docker compose example:
# SERVICE_MODE=compose
# COMPOSE_FILE=/opt/tiku-saas/current/docker-compose.api.yml

# Fully custom restart hook. Runs after current symlink switches.
# RESTART_COMMAND='systemctl restart tiku-api.service tiku-workers.target'

# Production refuses to report success without this healthcheck.
HEALTHCHECK_URL=http://127.0.0.1:8787/health
HEALTHCHECK_TIMEOUT_SECONDS=60
HEALTHCHECK_INTERVAL_SECONDS=2