# Copy to .env and fill in. .env is gitignored.
# Local-dev values shown; for production use the https URLs.

# OIDC issuer (Authelia)
ISSUER_URL=https://auth.maisym.com

# OIDC client — must match the client registered in Authelia
OIDC_CLIENT_ID=hsa-tracker
OIDC_CLIENT_SECRET=<plaintext from secret.sh — the one you saved>

# Where Authelia redirects back. Must be registered in the client's redirect_uris.
# Local dev:
REDIRECT_URL=http://localhost:8080/callback
# Production would be: https://hsa.maisym.com/callback

# Group that gates access (403 if the user isn't in it)
REQUIRED_GROUP=hsa-users

# Any random string; used to derive the session-cookie encryption key.
# Generate one with: openssl rand -base64 32
SESSION_SECRET=

# Listen address
LISTEN_ADDR=:8080

# Storage (defaults shown; relative paths are resolved from the app's working dir).
# For the LXC deployment use absolute paths under /var/lib/hsa.
# STORAGE_DIR is the storage ROOT — receipt files go under <STORAGE_DIR>/receipts/
# <year>/ and attachments under <STORAGE_DIR>/attachments/<year>/.
DB_PATH=./data/hsa.db
STORAGE_DIR=./data

# Max upload size in megabytes (reject larger). Camera photos can be ~10MB.
MAX_UPLOAD_MB=32

# Scheduled metadata-only DB backups (no image blobs). On by default, weekly.
# Files are named hsa_sqlite_backup_YYYY_MM_DD.db (one per day).
# BACKUP_INTERVAL sets the frequency: a Go duration (e.g. 168h weekly, 24h daily,
# 72h every 3 days); set 0 to disable.
BACKUP_DIR=./data/dbbackup
BACKUP_INTERVAL=168h
BACKUP_KEEP=8

# People + categories catalog (seeded into the DB on startup).
CONFIG_PATH=./config.json

# Receipt auto-classification (Anthropic). Leave CLAUDE_API_KEY empty to disable.
# Tests never need this: they use a mock endpoint (or the cheapest model when
# HSA_CLASSIFY_IT=1 is set explicitly).
CLAUDE_API_KEY=
# Cheap model by default — every receipt upload makes one classification call, so
# keep this cheap unless you specifically need a stronger model. The active model
# is shown as a footnote on the upload page so you always know what a scan costs.
CLASSIFY_MODEL=claude-haiku-4-5-20251001