# Server
HOST=0.0.0.0
PORT=5050

# Database (dynamic credentials from Vault)
{{ with secret "database/creds/nexus-app" -}}
DATABASE_URL=postgresql://{{ .Data.username }}:{{ .Data.password }}@db.example.local:5432/nexus
{{- end }}

# Valkey/Redis
{{ with secret "secret/data/nexus/valkey" -}}
VALKEY_URL=redis://{{ .Data.data.username }}:{{ .Data.data.password }}@{{ .Data.data.host }}:{{ .Data.data.port }}/0
VALKEY_KEY_PREFIX={{ .Data.data.key_prefix }}
{{- end }}

# S3 Storage
{{ with secret "secret/data/nexus/s3" -}}
S3_ENDPOINT={{ .Data.data.endpoint }}
S3_BUCKET={{ .Data.data.bucket }}
S3_ACCESS_KEY={{ .Data.data.access_key }}
S3_SECRET_KEY={{ .Data.data.secret_key }}
{{- end }}

# Ory Oathkeeper
{{ with secret "secret/data/nexus/oathkeeper" -}}
OATHKEEPER_SECRET={{ .Data.data.secret }}
{{- end }}

# Google Services (Calendar & Gmail)
{{ with secret "secret/data/nexus/google" -}}
GOOGLE_SERVICE_ACCOUNT_KEY={{ .Data.data.service_account_key }}
GOOGLE_CALENDAR_ID={{ .Data.data.calendar_id }}
GOOGLE_GMAIL_USER={{ .Data.data.gmail_user }}
{{- end }}

# Wave Accounting
{{ with secret "secret/data/nexus/wave" -}}
WAVE_ACCESS_TOKEN={{ .Data.data.access_token }}
WAVE_BUSINESS_ID={{ .Data.data.business_id }}
{{- end }}

# Logging
RUST_LOG=nexus=info,tower_http=info