env.deploy.example

# Deployment env for docker-compose.prod.yml.
# Copy to .env (gitignored) and fill in:  cp env.deploy.example .env

# --- Required ---
POSTGRES_PASSWORD=change-me
# Host path for the Postgres data volume (survives image updates).
# TrueNAS: a dataset, e.g. /mnt/POOL/apps/workout-sync/pgdata
PGDATA_PATH=./pgdata

# --- Image + networking ---
IMAGE_TAG=main          # or a pinned :sha
APP_PORT=3000
USER_TZ=Australia/Sydney

# --- App secrets (blank = that feature disabled) ---
GROQ_API_KEY=           # workout vision extraction
HEVY_API_KEY=           # Hevy sync + catalog
FMA_BASE_URL=           # food-macro-api, reachable from the container (not localhost)
FMA_API_KEY=

# --- Agenda: Garmin + Google Calendar ---
# Garmin auto-mints/refreshes its token from email+password (REQUIRES 2FA OFF).
# Stores the password at rest — prefer TrueNAS secrets over plaintext here.
GARMIN_EMAIL=           # Garmin account email
GARMIN_PASSWORD=        # Garmin account password (2FA must be off)
# GARMIN_TOKEN_DIR=/tmp/garmin-token   # container-local token cache (no volume); default is fine
GARMIN_TOKEN_B64=       # optional first-boot seed; not needed once email+password are set
GOOGLE_SA_KEY=          # service-account key (inline JSON / base64 / path)
GCAL_ID=                # calendar id to read
AGENDA_SYNC_SECRET=     # guards POST /api/agenda/sync; required if internet-exposed