# /etc/erpcore/erpcore.env — settings + secrets for erpcore.service (production, erp.hexdive.com).
#
# Create once (docs/40-DEPLOYMENT.md, "Active" A.2):
#   install -m 640 -o root -g erp deploy/env/erpcore.env.example /etc/erpcore/erpcore.env
# then replace every CHANGE_ME / <port>. Never commit real values.
#
# Format rules (systemd EnvironmentFile, not a shell):
#   • comments only on their own line — a trailing "# ..." becomes part of the value
#   • ':' in a .NET config key becomes '__'
#   • wrap a value in double quotes if it contains spaces, quotes or backslashes
# After editing: Actions → "CI/CD - ERP Core" → Run workflow with deploy_backend.
# (The test environment is on hold — see deploy/on-hold/README.md.)

ASPNETCORE_ENVIRONMENT=Production
# Must match deploy/apache/erp.hexdive.com.conf and BACKEND_PORT in .gitea/workflows/ci-cd.yml
ASPNETCORE_URLS=http://127.0.0.1:5220

ConnectionStrings__DefaultConnection=Host=127.0.0.1;Port=5432;Database=ERPCore;Username=erpcore;Password=CHANGE_ME

AuthHex__BaseUrl=http://127.0.0.1:<authhex-port>
# Door policy — set the real AuthHex user type / role codes.
Auth__RequiredUserTypeCode=
Auth__RequiredRoleCode=

GeneralLedgerService__BaseUrl=http://127.0.0.1:<gl-port>/api/v1/
GeneralLedgerService__ApiKey=CHANGE_ME

# MUST be absolute and OUTSIDE /home/erp/core/publish — every backend deploy empties that folder.
# The workflow's "Guard data paths" step refuses to deploy otherwise.
FileStorage__RootPath=/var/lib/erpcore/hr-documents
LogFile__Path=/var/log/erpcore/erpcore-.log

# Production never seeds demo data.
Seed__DemoData=false