.env.example

# ============================================================================
# CARE Backend Environment Variables
# ============================================================================
# This file documents all supported environment variables in the Care backend.
# Copy this file to .env and modify values as needed for your environment.

# ============================================================================
# GENERAL / UTILITIES
# ============================================================================

# Path to the manage.py file (used by scripts)
MANAGE_PY_PATH=manage.py

# Directory for database backups
BACKUP_DIR="./care-backups"

# Number of days to retain database backups
DB_BACKUP_RETENTION_PERIOD=7

# Read environment variables from .env file (boolean: True/False)
# Default: False
# DJANGO_READ_DOT_ENV_FILE=False

# Application version identifier (string)
# Default: "unknown"
# APP_VERSION=unknown

# ============================================================================
# DATABASE CONFIGURATION
# ============================================================================

# PostgreSQL database connection settings
POSTGRES_USER=postgres
POSTGRES_PASSWORD=postgres
POSTGRES_HOST=db
POSTGRES_DB=care
POSTGRES_PORT=5432

# Full database URL (takes precedence over individual POSTGRES_* variables)
# Format: postgres://username:password@host:port/database
DATABASE_URL=postgres://postgres:postgres@localhost:5433/care

# Maximum age of database connections in seconds (integer)
# Default: 0 (disabled) in base, 60 in deployment
# CONN_MAX_AGE=0

# ============================================================================
# REDIS CONFIGURATION
# ============================================================================

# Redis URL for caching
# Default: redis://localhost:6379
REDIS_URL=redis://localhost:6380

# Celery broker URL (usually Redis) (string, optional)
# Default: Same as REDIS_URL
# CELERY_BROKER_URL=redis://localhost:6380/0

# Timeout for setnx lock operations in seconds (integer)
# Default: 32
# LOCK_TIMEOUT=32

# ============================================================================
# DJANGO CORE SETTINGS
# ============================================================================

# Django secret key for cryptographic signing (string)
# IMPORTANT: Change this in production!
# Default: A default key (DO NOT USE IN PRODUCTION)
# DJANGO_SECRET_KEY=eXZQzOzx8gV38rDG0Z0fFZWweUGl3LwMZ9aTKqJiXQTI0nKMh0Z7sbHfqT8KFEnd

# Enable Django debug mode (boolean: True/False)
# Default: False
DJANGO_DEBUG=False

# Allowed hosts for the application (JSON array)
# Default: ["*"]
# DJANGO_ALLOWED_HOSTS=["*"]

# Django admin URL path (string)
# Default: "admin"
# DJANGO_ADMIN_URL=admin

# CSRF trusted origins (JSON array)
# Default: []
# CSRF_TRUSTED_ORIGINS=[]

# CORS allowed origins (JSON array)
# Default: []
# CORS_ALLOWED_ORIGINS=[]

# CORS allowed origin regexes (JSON array)
# Default: []
# CORS_ALLOWED_ORIGIN_REGEXES=[]

# ============================================================================
# SECURITY SETTINGS
# ============================================================================

# Enable secure SSL redirect (boolean: True/False)
# Default: True in deployment
# DJANGO_SECURE_SSL_REDIRECT=True

# Include subdomains in HSTS policy (boolean: True/False)
# Default: True in deployment
# DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS=True

# Enable HSTS preload (boolean: True/False)
# Default: True in deployment
# DJANGO_SECURE_HSTS_PRELOAD=True

# Enable content type nosniff header (boolean: True/False)
# Default: True in deployment
# DJANGO_SECURE_CONTENT_TYPE_NOSNIFF=True

# ============================================================================
# EMAIL CONFIGURATION
# ============================================================================

# Email backend to use (string)
# Default: django.core.mail.backends.smtp.EmailBackend
# DJANGO_EMAIL_BACKEND=django.core.mail.backends.smtp.EmailBackend

# Default "from" email address (string)
# Default: "Open Healthcare Network <ops@care.ohc.network>"
# EMAIL_FROM="Open Healthcare Network <ops@care.ohc.network>"

# Email server hostname (string)
# Default: localhost
# EMAIL_HOST=localhost

# Email server port (integer)
# Default: 587
# EMAIL_PORT=587

# Email server username (string)
# Default: ""
# EMAIL_USER=

# Email server password (string)
# Default: ""
# EMAIL_PASSWORD=

# Use TLS for email (boolean: True/False)
# Default: False (True in deployment)
# EMAIL_USE_TLS=False

# Email subject prefix (string)
# Default: "[Care]"
# DJANGO_EMAIL_SUBJECT_PREFIX=[Care]

# ============================================================================
# S3 / OBJECT STORAGE CONFIGURATION
# ============================================================================

# Cloud storage provider (string: AWS, GCP, AZURE, etc.)
# Default: "aws"
# BUCKET_PROVIDER=aws

# Primary bucket configuration
BUCKET_REGION=ap-south-1
BUCKET_KEY=key
BUCKET_SECRET=secret
BUCKET_ENDPOINT=http://localhost:4566
BUCKET_EXTERNAL_ENDPOINT=http://localhost:4566

# Enable fine-grained ACL control on buckets (boolean: True/False)
# Default: False
# BUCKET_HAS_FINE_ACL=False

# File upload bucket configuration
FILE_UPLOAD_BUCKET=patient-bucket

# File upload bucket region (string)
# Default: Same as BUCKET_REGION
# FILE_UPLOAD_REGION=ap-south-1

# File upload bucket access key (string)
# Default: Same as BUCKET_KEY
# FILE_UPLOAD_KEY=key

# File upload bucket secret key (string)
# Default: Same as BUCKET_SECRET
# FILE_UPLOAD_SECRET=secret

# File upload bucket endpoint (string)
# Default: Same as BUCKET_ENDPOINT
# FILE_UPLOAD_BUCKET_ENDPOINT=http://localhost:4566

# File upload bucket external endpoint (string)
# Default: BUCKET_EXTERNAL_ENDPOINT if BUCKET_ENDPOINT is set, else FILE_UPLOAD_BUCKET_ENDPOINT
# FILE_UPLOAD_BUCKET_EXTERNAL_ENDPOINT=http://localhost:4566

# Facility bucket configuration
FACILITY_S3_BUCKET=facility-bucket

# Facility S3 region (string)
# Default: Same as BUCKET_REGION
# FACILITY_S3_REGION_CODE=ap-south-1

# Facility S3 access key (string)
# Default: Same as BUCKET_KEY
# FACILITY_S3_KEY=key

# Facility S3 secret key (string)
# Default: Same as BUCKET_SECRET
# FACILITY_S3_SECRET=secret

# Facility S3 bucket endpoint (string)
# Default: Same as BUCKET_ENDPOINT
# FACILITY_S3_BUCKET_ENDPOINT=http://localhost:4566

# Facility S3 bucket external endpoint (string)
# Default: BUCKET_EXTERNAL_ENDPOINT if BUCKET_ENDPOINT is set, else FACILITY_S3_BUCKET_ENDPOINT
# FACILITY_S3_BUCKET_EXTERNAL_ENDPOINT=http://localhost:4566

# Facility CDN URL (string, optional)
# Default: None
# FACILITY_CDN=

# ============================================================================
# FILE UPLOAD SETTINGS
# ============================================================================

# Maximum file upload size in MB (integer)
# Default: 5
# MAX_FILE_UPLOAD_SIZE=5

# Allowed MIME types for file uploads (comma-separated list)
# Default: Comprehensive list of image, video, audio, and document types
# ALLOWED_MIME_TYPES=image/jpeg,image/png,image/gif,video/mp4,audio/mpeg,application/pdf,...

# Allowed file extensions for uploads (comma-separated list)
# Default: Comprehensive list of safe extensions
# ALLOWED_FILE_EXTENSIONS=jpg,jpeg,png,gif,mp4,mp3,pdf,doc,xls,...

# Blocked file extensions (comma-separated list)
# Default: exe,dll,bat,cmd,sh,sys,reg,...
# BLOCKED_FILE_EXTENSIONS=exe,dll,bat,cmd,sh,...

# Expiry time for incomplete file uploads in hours (integer)
# Default: 24 (set to 0 to disable cleanup)
# FILE_UPLOAD_EXPIRY_HOURS=24

# ============================================================================
# JWT AUTHENTICATION
# ============================================================================

# JWT access token lifetime in minutes (integer)
# Default: 10
# JWT_ACCESS_TOKEN_LIFETIME=10

# JWT refresh token lifetime in minutes (integer)
# Default: 30
# JWT_REFRESH_TOKEN_LIFETIME=30

# JWKS (JSON Web Key Set) base64-encoded (string)
# Used for OpenID Connect authentication
# Default: Generated from file
# JWKS_BASE64=

# ============================================================================
# SENTRY (ERROR TRACKING)
# ============================================================================

# Sentry DSN for error tracking (string)
# Default: "" (disabled)
# SENTRY_DSN=

# Sentry environment name (string)
# Default: "deployment-unknown"
# SENTRY_ENVIRONMENT=production

# Sentry traces sample rate (float: 0.0 to 1.0)
# Default: 0
# SENTRY_TRACES_SAMPLE_RATE=0

# Sentry profiles sample rate (float: 0.0 to 1.0)
# Default: 0
# SENTRY_PROFILES_SAMPLE_RATE=0

# Sentry event logging level (integer)
# Default: logging.ERROR (40)
# SENTRY_EVENT_LEVEL=40

# ============================================================================
# SMS / SNS CONFIGURATION
# ============================================================================

# Enable SMS functionality (boolean: True/False)
# Default: False (True in staging/production)
# USE_SMS=False

# AWS SNS access key for SMS (string)
# Default: ""
# SNS_ACCESS_KEY=

# AWS SNS secret key for SMS (string)
# Default: ""
# SNS_SECRET_KEY=

# AWS SNS region (string)
# Default: "ap-south-1"
# SNS_REGION=ap-south-1

# Use SNS role-based authentication (boolean: True/False)
# Default: False
# SNS_ROLE_BASED_MODE=False

# OTP SMS template path (string)
# Default: "sms/otp_sms.txt"
# OTP_SMS_TEMPLATE=sms/otp_sms.txt

# ============================================================================
# EMAIL TEMPLATES
# ============================================================================

# User create password email template path (string)
# Default: "email/user_create_password.html"
# USER_CREATE_PASSWORD_TEMPLATE_PATH=email/user_create_password.html

# User reset password email template path (string)
# Default: "email/user_reset_password.html"
# USER_RESET_PASSWORD_TEMPLATE_PATH=email/user_reset_password.html

# TOTP enabled email template path (string)
# Default: "email/totp_enabled.html"
# TOTP_ENABLED_EMAIL_TEMPLATE_PATH=email/totp_enabled.html

# TOTP disabled email template path (string)
# Default: "email/totp_disabled.html"
# TOTP_DISABLED_EMAIL_TEMPLATE_PATH=email/totp_disabled.html

# ============================================================================
# RATE LIMITING & CAPTCHA
# ============================================================================

# Disable rate limiting (boolean: True/False)
# Default: False
# DISABLE_RATELIMIT=False

# Rate limit specification (string, format: count/period)
# Example: "5/10m" means 5 requests per 10 minutes
# Default: "5/10m"
# RATE_LIMIT=5/10m

# Google reCAPTCHA secret key (string)
# Default: ""
# GOOGLE_RECAPTCHA_SECRET_KEY=

# Google reCAPTCHA site key (string)
# Default: ""
# GOOGLE_RECAPTCHA_SITE_KEY=

# ============================================================================
# AUDIT LOGS
# ============================================================================

# Enable audit logging (boolean: True/False)
# Default: False
# AUDIT_LOG_ENABLED=False

# ============================================================================
# MAINTENANCE MODE
# ============================================================================

# Enable maintenance mode (integer: 0 or 1)
# Default: 0 (disabled)
# MAINTENANCE_MODE=0

# ============================================================================
# DOMAIN CONFIGURATION
# ============================================================================

# Current frontend domain (string)
# Default: "localhost:4000"
# CURRENT_DOMAIN=localhost:4000

# Backend API domain (string)
# Default: "localhost:9000"
# BACKEND_DOMAIN=localhost:9000

# ============================================================================
# MIDDLEWARE & PERFORMANCE
# ============================================================================

# Enable request time logging middleware (boolean: True/False)
# Default: False
# ENABLE_REQUEST_TIME_LOGGING=False

# Middleware request timeout in seconds (integer)
# Default: 20
# MIDDLEWARE_REQUEST_TIMEOUT=20

# ============================================================================
# EXTERNAL SERVICES
# ============================================================================

# Snowstorm FHIR server URL for SNOMED CT (string)
# Default: "http://165.22.211.144/fhir"
# SNOWSTORM_DEPLOYMENT_URL=http://165.22.211.144/fhir

# ============================================================================
# BUSINESS LOGIC / EMR CONFIGURATION
# ============================================================================

# Maximum data points per upsert operation (integer)
# Default: 100
# MAX_DATAPOINTS_PER_UPSERT=100

# Maximum requests per batch request (integer)
# Default: 20
# MAX_REQUESTS_PER_BATCH_REQUEST=20

# Maximum appointments per patient (integer)
# Default: 10
# MAX_APPOINTMENTS_PER_PATIENT=10

# Maximum active encounters per patient in a facility (integer)
# Default: 5
# MAX_ACTIVE_ENCOUNTERS_PER_PATIENT_IN_FACILITY=5

# Password reset token TTL in hours (integer)
# Default: 24
# PASSWORD_RESET_TOKEN_TTL_HOURS=24

# Maximum favorites per list (integer)
# Default: 50
# MAX_FAVORITES_PER_LIST=50

# Maximum location hierarchy depth (integer)
# Default: 10
# LOCATION_MAX_DEPTH=10

# Maximum organization hierarchy depth (integer)
# Default: 10
# ORGANIZATION_MAX_DEPTH=10

# Maximum facility organization hierarchy depth (integer)
# Default: 10
# FACILITY_ORGANIZATION_MAX_DEPTH=10

# Maximum locations in a facility (integer)
# Default: 1000
# MAX_LOCATION_IN_FACILITY=1000

# Maximum organizations in a facility (integer)
# Default: 1000
# MAX_ORGANIZATION_IN_FACILITY=1000

# Maximum slots per availability (integer)
# Default: 30
# MAX_SLOTS_PER_AVAILABILITY=30

# Maximum questionnaire text response size (integer)
# Default: 2500
# MAX_QUESTIONNAIRE_TEXT_RESPONSE_SIZE=2500

# Tax codes configuration (JSON array)
# Default: Predefined Indian tax codes (IGST, CGST, SGST, UTGST)
# TAX_CODES=[]

# Tax monetary component definitions (JSON array)
# Default: Predefined tax slabs (18%, 12%, 5%)
# TAX_MONETARY_COMPONENT_DEFINITIONS=[]

# Discount codes configuration (JSON array)
# Default: Predefined discount codes (oldage, child, student)
# DISCOUNT_CODES=[]

# Discount monetary component definitions (JSON array)
# Default: Predefined discount definitions
# DISCOUNT_MONETARY_COMPONENT_DEFINITIONS=[]

# Informational monetary codes (JSON array)
# Default: [{"code": "mrp", "display": "MRP", ...}]
# INFORMATIONAL_MONETARY_CODES=[]

# Maintain patient name identifier (boolean: True/False)
# Default: False
# MAINTAIN_PATIENT_NAME_IDENTIFIER=False

# Maintain patient phone number identifier (boolean: True/False)
# Default: False
# MAINTAIN_PATIENT_PHONE_NUMBER_IDENTIFIER=False

# Maintain facility patient name identifier (boolean: True/False)
# Default: True
# MAINTAIN_FACILITY_PATIENT_NAME_IDENTIFIER=True

# Patient name maximum length (integer)
# Default: 75
# PATIENT_NAME_MAX_LENGTH=75

# Encounter restart time limit in hours (integer)
# Default: 0 (disabled)
# ENCOUNTER_RESTART_TIME_LIMIT_HOURS=0


# ============================================================================
# DEVELOPMENT / DEBUGGING
# ============================================================================

# Enable Django Silk profiler for development (boolean: True/False)
# Default: False
# ENABLE_SILK=False

# Attach debugger for development (boolean: True/False)
# Default: False
# ATTACH_DEBUGGER=False