# Kamal secrets for the EchoBark hub.
#
# Every value here is pulled from your shell environment — no literal secrets in
# the repo. Set these before running `bin/kamal`:
#
#   KAMAL_REGISTRY_PASSWORD   a GitHub PAT with `write:packages` (login to ghcr.io)
#   MAYLYN_SERVE_TOKEN        any long random string (the hub's admin API token)
#   POSTGRES_PASSWORD         any long random string
#   SECRETS_COOKIE            32+ random chars (Kratos cookie signing)
#   SECRETS_CIPHER            exactly 32 chars (Kratos AES-256 cipher key)
#
# Generate the random ones:  openssl rand -hex 32
#
# For a production destination, put a real SMTP URI in .kamal/secrets.production
# (COURIER_SMTP_CONNECTION_URI=smtps://...); dev uses the Mailpit accessory.

KAMAL_REGISTRY_PASSWORD=$KAMAL_REGISTRY_PASSWORD
MAYLYN_SERVE_TOKEN=$MAYLYN_SERVE_TOKEN
POSTGRES_PASSWORD=$POSTGRES_PASSWORD
SECRETS_COOKIE=$SECRETS_COOKIE
SECRETS_CIPHER=$SECRETS_CIPHER

# Composed from the above — Kamal expands ${...} against earlier entries.
DSN=postgres://kratos:${POSTGRES_PASSWORD}@maylyn-hub-postgres:5432/kratos?sslmode=disable

# Dev mail goes to the Mailpit accessory on the Kamal network. Overridden in
# .kamal/secrets.production with a real provider.
COURIER_SMTP_CONNECTION_URI=smtp://maylyn-hub-mailpit:1025/?disable_starttls=true
