.env.example

# Django Core
SECRET_KEY=your-secret-key-here-generate-with-django
DEBUG=False

# ALLOWED_HOSTS - Comma-separated list of domains
# Supports wildcards: *.example.com
# Use '*' to allow all domains (not recommended for production)
# When DEBUG=True, all hosts are automatically allowed
# Examples:
#   ALLOWED_HOSTS=example.com,www.example.com,*.example.com
#   ALLOWED_HOSTS=192.168.1.100,myapp.local
ALLOWED_HOSTS=yourdomain.com,www.yourdomain.com,*.yourdomain.com

# CSRF_TRUSTED_ORIGINS - Required for HTTPS POST requests
# Auto-generated from ALLOWED_HOSTS if not set
# Must include protocol (https:// or http://)
# Examples:
#   CSRF_TRUSTED_ORIGINS=https://example.com,https://www.example.com
#   CSRF_TRUSTED_ORIGINS=https://*.yourdomain.com,http://192.168.1.100:8000
# CSRF_TRUSTED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com

# Database
DB_NAME=itdocs
DB_USER=itdocs
DB_PASSWORD=secure-db-password-here
DB_HOST=localhost
DB_PORT=3306

# Encryption Master Key (base64-encoded 32 bytes)
# Generate with: python -c "import os, base64; print(base64.b64encode(os.urandom(32)).decode())"
# NOTE: This is AUTO-GENERATED on first demo data import if not set
# Keep this key secure and never change it after data is encrypted!
APP_MASTER_KEY=

# File Storage
UPLOAD_ROOT=/var/lib/itdocs/uploads

# Security
REQUIRE_2FA=True
SESSION_COOKIE_SECURE=True
CSRF_COOKIE_SECURE=True
SECURE_HSTS_SECONDS=31536000
SECURE_SSL_REDIRECT=True

# Axes (brute force protection)
AXES_FAILURE_LIMIT=5
AXES_COOLOFF_TIME=1

# API Keys
API_KEY_SECRET=your-api-key-hmac-secret-here

# Integrations Security
# WARNING: Enabling private IPs disables SSRF (Server-Side Request Forgery) protection
# Only enable if you need to connect to self-hosted services on your internal network
# ALLOW_PRIVATE_IP_INTEGRATIONS=False  # Set to True to allow RFC1918 private IPs (10.x, 172.16-31.x, 192.168.x)