.env.example

# Toolbox for Firefly III Configuration

# =============================================================================
# CORE SETTINGS
# =============================================================================

# Firefly III API Configuration
FIREFLY_API_URL=http://localhost:8080
FIREFLY_API_TOKEN=your_firefly_api_token_here

# Self-Signed Certificates (common in homelabs)
# If your Firefly III instance uses a self-signed certificate or a private CA,
# Node.js will reject the connection by default. To fix this, set the
# NODE_EXTRA_CA_CERTS environment variable to point to your CA certificate:
#
#   NODE_EXTRA_CA_CERTS=/path/to/your-ca-cert.pem
#
# In Docker, mount the certificate and set the variable:
#   volumes:
#     - /path/to/your-ca-cert.pem:/certs/ca.pem:ro
#   environment:
#     - NODE_EXTRA_CA_CERTS=/certs/ca.pem
#
# Note: This is a Node.js environment variable, not an app-specific setting.

# Server Configuration
PORT=3000
NODE_ENV=development

# Public URL of this application (used for OAuth callbacks)
APP_URL=http://localhost:3000

# CORS Configuration (comma-separated list of allowed origins)
CORS_ORIGINS=http://localhost:5173,http://localhost:3000

# =============================================================================
# AUTHENTICATION
# =============================================================================

# Enabled authentication methods (comma-separated list)
# Options: 'basic', 'oidc', 'firefly', 'none'
# Examples:
#   AUTH_METHODS=firefly          - Only Firefly III OAuth login
#   AUTH_METHODS=basic,firefly    - Both basic auth and Firefly III OAuth
#   AUTH_METHODS=none             - No authentication required
# If not set, auto-detects all configured auth methods
# AUTH_METHODS=basic,firefly

# Session secret (REQUIRED in production, auto-generated in development)
# Generate with: openssl rand -hex 32
# AUTH_SESSION_SECRET=your_secure_random_secret_here

# Allow running without authentication in production (NOT RECOMMENDED)
# Only set this if you understand the security implications
# AUTH_ALLOW_INSECURE=false

# --- Basic Auth ---
# Simple username/password authentication
# AUTH_BASIC_USERNAME=admin
# AUTH_BASIC_PASSWORD=your_secure_password_here

# --- OIDC (Single Sign-On) ---
# For Authentik, Keycloak, Auth0, etc.
# Callback URL: {APP_URL}/api/auth/oidc/callback
# Example: http://localhost:3000/api/auth/oidc/callback
# AUTH_OIDC_ISSUER_URL=https://auth.example.com/application/o/toolbox-for-firefly-iii/
# AUTH_OIDC_CLIENT_ID=your_oidc_client_id
# AUTH_OIDC_CLIENT_SECRET=your_oidc_client_secret
# AUTH_OIDC_SCOPES=openid profile email

# --- Firefly III OAuth ---
# Login using your Firefly III account
# Create an OAuth client in Firefly III: Options > Profile > OAuth > Create New Client
# - Check "Confidential" for confidential clients (recommended, requires secret)
# - Leave unchecked for public clients (no secret needed)
# Callback URL: {APP_URL}/api/auth/firefly/callback
# Example: http://localhost:3000/api/auth/firefly/callback
# AUTH_FIREFLY_CLIENT_ID=your_firefly_oauth_client_id
# AUTH_FIREFLY_CLIENT_SECRET=your_firefly_oauth_client_secret  # Optional for public clients

# =============================================================================
# AI CONFIGURATION (Optional - for category/tag suggestions)
# =============================================================================

# Choose your AI provider: 'openai' or 'ollama'
AI_PROVIDER=openai

# OpenAI Configuration (when AI_PROVIDER=openai)
OPENAI_API_KEY=your_openai_api_key_here
OPENAI_API_URL=https://api.openai.com/v1
OPENAI_MODEL=gpt-4o-mini

# Ollama Configuration (when AI_PROVIDER=ollama)
# OLLAMA_API_URL=http://localhost:11434
# OLLAMA_MODEL=llama3.2

# Alternative: Use AI_MODEL to set the model regardless of provider
# AI_MODEL=gpt-4o-mini

# =============================================================================
# LOGGING
# =============================================================================

# Log level: 'debug', 'info', 'warn', 'error', or 'silent'
# LOG_LEVEL=info

# Disable colored output (set to 'true' or '1' to disable)
# NO_COLOR=false

# Force colored output even when not in a TTY
# LOG_COLOR=true

# Log format string
# Supported placeholders: {datetime}, {level}, {levelname}, {context}, {where}, {message}
# Default: {datetime} {level} [{context}] {message}
# LOG_FORMAT={datetime} {level} [{context}] {message}

# =============================================================================
# OTHER FEATURES
# =============================================================================

# FinTS/HBCI Configuration (for German bank imports)
# Register for a product ID at: https://www.hbci-zka.de/register/hersteller.htm
# FINTS_PRODUCT_ID=your_fints_product_id

# Redact sensitive FinTS data from logs by default.
# Set to false only for temporary debugging when you explicitly want raw bank payloads in logs.
# FINTS_LOG_REDACTION=true

# Default application language
# DEFAULT_LOCALE=en  # Options: 'en', 'de'

# Number formatting (for parsing bank exports)
# NUMBER_FORMAT_LOCALE=en-US
# NUMBER_FORMAT_DECIMAL=.
# NUMBER_FORMAT_THOUSANDS=,