.env.example

# Copy this file to .env for local development.
# Keep real secret values in .env or your deployment platform, not in git.

# Settings module used by manage.py check, migrations, and runtime startup.
DJANGO_SETTINGS_MODULE=config.settings.local

# Required secret. Generate a unique value for each environment.
DJANGO_SECRET_KEY=replace-me-with-a-generated-secret-key-of-at-least-50-characters

# Local development defaults
DJANGO_DEBUG=True
DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,0.0.0.0
DJANGO_CSRF_TRUSTED_ORIGINS=http://localhost:8000,http://127.0.0.1:8000

# Local web port used by Docker Compose.
WEB_PORT=8000

# PostgreSQL connection used by Docker Compose and Django migration preparation.
# POSTGRES_PORT also controls the host port published by the local db service.
POSTGRES_DB=trackly
POSTGRES_USER=trackly_user
POSTGRES_PASSWORD=replace-me-with-a-local-db-password
POSTGRES_HOST=db
POSTGRES_PORT=5432
DATABASE_URL=postgres://trackly_user:replace-me-with-a-local-db-password@db:5432/trackly

# Optional release marker for CI/deployment observability.
RELEASE_VERSION=local

# Optional logging levels for production settings.
LOG_LEVEL=INFO
DJANGO_LOG_LEVEL=INFO

# Production-only hardening defaults.
# These are read by config.settings.production.
DJANGO_SECURE_SSL_REDIRECT=True
DJANGO_SESSION_COOKIE_SECURE=True
DJANGO_CSRF_COOKIE_SECURE=True
DJANGO_SECURE_HSTS_SECONDS=31536000
DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS=True
DJANGO_SECURE_HSTS_PRELOAD=True
DJANGO_SECURE_CONTENT_TYPE_NOSNIFF=True
DJANGO_X_FRAME_OPTIONS=DENY
DJANGO_REFERRER_POLICY=same-origin