# BizGaze Support — server secrets / config.
# Copy this file to `.env` next to docker-compose.yml on the server and fill in
# real values. The real `.env` is gitignored — NEVER commit credentials.
# Compose injects these into the container via `env_file:`.

# Managed TURN relay (Metered) — makes WebRTC work on mobile/cellular & strict NATs.
# Comma-separated URL list; username + credential from the Metered dashboard.
TURN_URLS=turn:global.relay.metered.ca:80,turn:global.relay.metered.ca:80?transport=tcp,turn:global.relay.metered.ca:443,turns:global.relay.metered.ca:443?transport=tcp
TURN_USERNAME=
TURN_CREDENTIAL=

# Optional: open self-registration of the first/any team (1 to enable).
# ALLOW_REGISTRATION=1

# Optional: BizGaze as the identity provider. When set, /api/login validates
# credentials against this endpoint (after a local check) and provisions the user.
# BIZGAZE_LOGIN_URL=https://c02.bizgaze.app/Account/ValidateAndLogin

# Optional: shared secret for BizGaze SSO + signed webhook delivery.
# SSO_SECRET=

# Optional: BizGaze webhook endpoint for session events.
# BIZGAZE_WEBHOOK_URL=

# Optional: LiveKit SFU for meetings (scales past the ~5-peer P2P mesh). Set ALL THREE to enable;
# leave unset to keep the built-in mesh. The app mints join tokens with the secret (server-side
# only); the same key/secret feed the livekit container via LIVEKIT_KEYS in docker-compose.
# Generate a key/secret pair: two random strings, e.g. `openssl rand -hex 16` for each.
# LIVEKIT_URL=wss://livekit.bizgaze.com
# LIVEKIT_API_KEY=
# LIVEKIT_API_SECRET=
