# Database
APP_ENVIRONMENT=development
SECURITY_STRICT_MODE=false
CORS_ALLOWED_ORIGINS=http://localhost:8102,http://127.0.0.1:8102
TRUSTED_HOSTS=*
SECURITY_HEADERS_ENABLED=true

POSTGRES_USER=admin
POSTGRES_PASSWORD=password
POSTGRES_DB=kg_admin
DATABASE_URL=postgresql://admin:password@postgres:5432/kg_admin
DB_SCHEMA=kg_admin_new2
DB_MIGRATIONS_ENABLED=false

# Data Center MySQL (independent from graph/system PostgreSQL)
MYSQL_ROOT_PASSWORD=change-this-root-password
MYSQL_DATABASE=platform_control
MYSQL_USER=data_center
MYSQL_PASSWORD=change-this-data-password
MYSQL_ACCESS_BROKER_USER=access_broker
MYSQL_ACCESS_BROKER_PASSWORD=change-this-access-broker-credential
DATA_MYSQL_URL=mysql://data_center:change-this-data-password@mysql:3306/platform_control
DATA_MYSQL_REQUIRED=true
DATA_MYSQL_POOL_MIN_SIZE=2
DATA_MYSQL_POOL_MAX_SIZE=20
DATA_SQL_CONSOLE_WRITE_ENABLED=false
INTERFACE_API_SECRET=change-me-interface-api-secret
DATA_MYSQL_DIRECT_ACCESS_ENABLED=true
# Legacy fallback used by older deployments. Prefer DATA_MYSQL_SSH_HOST.
DATA_MYSQL_PUBLIC_HOST=
DATA_MYSQL_PUBLIC_PORT=0
DATA_MYSQL_DIRECT_TRANSPORT=SSH 隧道（强制）
DATA_MYSQL_SSH_TUNNEL_REQUIRED=true
DATA_MYSQL_SSH_HOST=
DATA_MYSQL_SSH_PORT=2222
DATA_MYSQL_SSH_BIND=127.0.0.1
DATA_MYSQL_SSH_USERNAME=dbeaver
DATA_MYSQL_SSH_AUTH_METHOD=SSH 私钥 / SSH Agent
DATA_MYSQL_MANAGED_ACCESS_ENABLED=true
DATA_MYSQL_SSH_AUTHORIZED_KEYS_FILE=/var/lib/travel-kg/dbeaver-access/authorized_keys
DATA_MYSQL_SSH_HOST_PUBLIC_KEY_FILE=/var/lib/travel-kg/dbeaver-access/ssh_host_ed25519_key.pub
DATA_MYSQL_PROVISIONER_USER=access_broker
DATA_MYSQL_PROVISIONER_PASSWORD=change-this-access-broker-credential
DATA_MYSQL_ADMIN_HOST=127.0.0.1
DATA_MYSQL_ADMIN_PORT=3307
DATA_MYSQL_ADMIN_ACCOUNT_POLICY=一人一号 · 单库授权 · 禁止 root
DATA_MYSQL_AUDIT_ENABLED=false
# 开发环境继续使用 Docker named volume。生产服务器覆盖文件强制改为独立块存储：
DATA_MYSQL_STORAGE_BACKEND=docker-volume
# 生产示例：/mnt/sdr、prod-mysql-storage-01、/mnt/sdr/nianxx/mysql
MYSQL_STORAGE_MOUNT=
MYSQL_STORAGE_ID=
MYSQL_DATA_DIR=
# mysql:8.4 官方镜像默认用户；更换镜像时先核对 UID/GID。
MYSQL_CONTAINER_UID=999
MYSQL_CONTAINER_GID=999
DATA_BACKUP_ENABLED=false
DATA_BACKUP_ENCRYPTION_REQUIRED=true
DATA_BACKUP_RETENTION_DAYS=30
# 生产必须是代码仓库和 MySQL 运行目录之外的现有目录。
DATA_BACKUP_ROOT=
# 必须位于代码仓库之外，文件权限设为 600，内容至少 32 个随机字符。
DATA_BACKUP_PASSPHRASE_FILE=/etc/travel-kg/secrets/mysql-backup-passphrase

# FalkorDB
FALKORDB_HOST=falkordb
FALKORDB_INTERNAL_PORT=6379
FALKORDB_PORT=6380
FALKORDB_GRAPH=guiyang_new2
FALKORDB_PASSWORD=

# Auth
AUTH_SECRET=change-me-32-chars-minimum-secret
AUTH_ALGORITHM=HS256
AUTH_ISSUER=zn-kg-admin
AUTH_AUDIENCE=zn-kg-admin-web
AUTH_TOKEN_EXPIRE_MINUTES=60
AUTH_DEFAULT_USERNAME=admin@example.com
AUTH_DEFAULT_PASSWORD=change-me
AUTH_LOGIN_MAX_ATTEMPTS=5
AUTH_LOGIN_WINDOW_SECONDS=300
AUTH_LOGIN_LOCK_SECONDS=900
INTERFACE_API_DEFAULT_EXPIRY_DAYS=30
INTERFACE_API_MAX_EXPIRY_DAYS=90
INTERFACE_API_RATE_LIMIT_PER_MINUTE=120

# LLM, optional
LLM_PROVIDER=openai-compatible
LLM_API_BASE=
LLM_API_KEY=
LLM_MODEL=deepseek-chat
LLM_TIMEOUT_SECONDS=30
LLM_EXTRACTION_ENABLED=false

# App
DEFAULT_TENANT=CityGraph-new2
DEFAULT_PROJECT=CityGraph-new2
INGEST_API_KEYS=dev-key-1

# External services, optional
AMAP_WEB_KEY=
AMAP_JS_KEY=
AMAP_SECURITY_JSCODE=

# 阿里云 OCR (RecognizePassport 等), optional
ALIYUN_OCR_ACCESS_KEY_ID=
ALIYUN_OCR_ACCESS_KEY_SECRET=
ALIYUN_OCR_ENDPOINT=ocr-api.cn-hangzhou.aliyuncs.com
GAODE_CRAWLER_PATH=
TRAVEL_KG_DATA_ROOT=./data
TRAVEL_AGENCY_SOURCE_ROOT=./data/source/travel_agency
TRAVEL_DELIVERY_ROOT=./data/source/travel_delivery_20260602
TRAVEL_KG_EXPORT_ROOT=./data/exports
TRAVEL_KG_ENV_PATH=./.env

# Docker host ports
API_HOST_BIND=0.0.0.0
API_PORT=8102
POSTGRES_HOST_BIND=127.0.0.1
POSTGRES_PORT=5433
MYSQL_HOST_BIND=127.0.0.1
MYSQL_PORT=3307
FALKORDB_HOST_BIND=127.0.0.1
FALKORDB_PORT=6380
FALKORDB_BROWSER_HOST_BIND=127.0.0.1
FALKORDB_BROWSER_PORT=3002