# ACS (Access Control System) environment — copy to .env and edit

# Database
POSTGRES_USER=acs
POSTGRES_PASSWORD=change_me
POSTGRES_DB=acs

# Web (nginx) published port
WEB_PORT=80

# ===== Pass delivery =====
# dev     : no network — logs the message + writes the QR image to the outbox
# hanbank : sends an LMS with the public pass link via the in-house DMZ API
# email   : emails the pass (QR attached) via the SMTP relay below
ACS_SMS_PROVIDER=dev
ACS_SMS_API_URL=http://210.104.132.59:8000

# ===== Email pass delivery (only used when ACS_SMS_PROVIDER=email) =====
# Sender = shared departmental mailbox; relay = corporate SMTP server.
ACS_MAIL_FROM=dept_itcm000@bok.or.kr
ACS_MAIL_HOST=
ACS_MAIL_PORT=25
# Set only if the relay requires SMTP AUTH (internal relays often do not):
ACS_MAIL_USERNAME=
ACS_MAIL_PASSWORD=
ACS_MAIL_SMTP_AUTH=false
ACS_MAIL_STARTTLS=false
# URL the SMS link points to — MUST be reachable from the visitor's phone
# (the server's real address/domain, not localhost). e.g. https://acs.example.co.kr
ACS_PUBLIC_BASE_URL=http://localhost

# ===== Security =====
# CORS allowed origins (comma-separated). Leave EMPTY when web+API share one origin
# via nginx (default). Set only if the SPA is hosted on a different origin.
ACS_CORS_ALLOWED_ORIGINS=
# Set to true ONLY when the site is served over HTTPS — marks the session cookie Secure.
# Leaving it false over plain http keeps login working; true over http would break it.
ACS_COOKIE_SECURE=false