# MyDay — example configuration.
#
# Copy to `config.yaml` (gitignored — NEVER committed, D-010) and fill in.
# Settings live HERE, not in the database (D-035).

# ── setup & recovery ─────────────────────────────────────────────────────────
setup: true            # D-015 / D-026 — while true the app serves ONLY /setup (loopback-only)
admin_recovery: false  # D-033 — set true + restart to email user 1 an enrolment link

# ── server ───────────────────────────────────────────────────────────────────
server:
  listen: "127.0.0.1:8080"                # D-025 — loopback during setup; bind the public iface only after
  base_url: "https://myday.example.com"   # used in invite / recovery links
  trusted_proxies:                        # XFF is resolved from these (A6)
    - "127.0.0.1"

# ── app ──────────────────────────────────────────────────────────────────────
app:
  locale: "en-GB"
  timezone: "Europe/London"

# ── enrollment (A1) ──────────────────────────────────────────────────────────
# The bounded invite window: outside it, /{GUID} enrollment is refused.
enrollment:
  window: "72h"

# ── database (D-012) ─────────────────────────────────────────────────────────
database:
  path: "./data/myday.db"   # SQLite · WAL · foreign keys ON · one instance only

# ── secrets — generate strong random values; never commit (D-010) ────────────
# A placeholder is replaced with a strong value: at startup in setup mode
# (so the wizard's ceremony is never signed with a known key) and again by the
# wizard's `finish`. A restart adopts what `/setup` persisted.
secrets:
  cookie_secret: "CHANGE_ME_32_BYTES_RANDOM"
  csrf_key: "CHANGE_ME_32_BYTES_RANDOM"
  totp_encryption_key: "CHANGE_ME_32_BYTES_RANDOM"   # A9 — TOTP secrets are encrypted at rest

# ── mail — invites & recovery ────────────────────────────────────────────────
mail:
  host: "smtp.example.com"
  port: 587
  username: ""
  password: "CHANGE_ME"
  from: "myday@example.com"

# ── modules (D-038) — required modules cannot be disabled ────────────────────
modules:
  org: true
  time: true
  absence: true
  requests: true        # required
  hr: true
  expense: false
  reports: true
  integrations: false