server.port=8080

# PostgreSQL (дефолтный — для локальной разработки через Docker Compose)
spring.datasource.url=jdbc:postgresql://db:5432/app_db
spring.datasource.username=${POSTGRES_USER:myuser}
spring.datasource.password=${POSTGRES_PASSWORD:}
spring.datasource.driver-class-name=org.postgresql.Driver

# JPA
spring.jpa.hibernate.ddl-auto=none
spring.jpa.show-sql=false
spring.jpa.open-in-view=false
spring.jpa.properties.hibernate.jdbc.time_zone=UTC
spring.jackson.time-zone=UTC

# Единая зона календарных бизнес-дат. Абсолютные timestamps хранятся в UTC.
app.time.business-zone=${BUSINESS_TIME_ZONE:Europe/Moscow}

# Мультитенантность
app.tenants.config-path=${TENANTS_CONFIG_PATH:tenants.json}
app.tenants.config-required=${TENANTS_CONFIG_REQUIRED:false}

# Служебные liveness/readiness probes для Kubernetes
management.endpoints.web.exposure.include=health
management.endpoint.health.probes.enabled=true
management.endpoint.health.group.liveness.include=livenessState
management.endpoint.health.group.readiness.include=readinessState,tenantReadiness
management.endpoint.health.show-details=never
management.endpoint.health.show-components=never
management.health.db.enabled=false

# Фоновая проверка БД не должна задерживать watcher tenant Secret
spring.task.scheduling.pool.size=2

# JWT авторизация
app.jwt.secret=${JWT_SECRET:}
app.jwt.access-ttl=${JWT_ACCESS_TOKEN_TTL:15m}
app.jwt.refresh-ttl=${JWT_REFRESH_TOKEN_TTL:7d}
app.jwt.refresh-cookie-name=${JWT_REFRESH_COOKIE_NAME:magistr_refresh}
app.jwt.refresh-cookie-secure=${JWT_REFRESH_COOKIE_SECURE:false}
app.jwt.refresh-cleanup.enabled=${JWT_REFRESH_CLEANUP_ENABLED:true}
app.jwt.refresh-cleanup.retention=${JWT_REFRESH_CLEANUP_RETENTION:30d}
app.jwt.refresh-cleanup.batch-size=${JWT_REFRESH_CLEANUP_BATCH_SIZE:500}
app.jwt.refresh-cleanup.max-batches-per-tenant=${JWT_REFRESH_CLEANUP_MAX_BATCHES:20}
app.jwt.refresh-cleanup.interval-ms=${JWT_REFRESH_CLEANUP_INTERVAL_MS:3600000}
app.jwt.refresh-cleanup.initial-delay-ms=${JWT_REFRESH_CLEANUP_INITIAL_DELAY_MS:60000}

# Защита входа. X-Forwarded-For принимается только от перечисленных proxy-сетей.
app.login-security.max-failures=${LOGIN_RATE_MAX_FAILURES:5}
app.login-security.attempt-window=${LOGIN_RATE_ATTEMPT_WINDOW:15m}
app.login-security.base-block-duration=${LOGIN_RATE_BASE_BLOCK_DURATION:1m}
app.login-security.max-block-duration=${LOGIN_RATE_MAX_BLOCK_DURATION:15m}
app.login-security.audit-cleanup.enabled=${LOGIN_AUDIT_CLEANUP_ENABLED:true}
app.login-security.audit-cleanup.retention=${LOGIN_AUDIT_RETENTION:90d}
app.login-security.audit-cleanup.batch-size=${LOGIN_AUDIT_CLEANUP_BATCH_SIZE:500}
app.login-security.audit-cleanup.max-batches-per-tenant=${LOGIN_AUDIT_CLEANUP_MAX_BATCHES:20}
app.login-security.audit-cleanup.interval-ms=${LOGIN_AUDIT_CLEANUP_INTERVAL_MS:86400000}
app.login-security.audit-cleanup.initial-delay-ms=${LOGIN_AUDIT_CLEANUP_INITIAL_DELAY_MS:120000}
app.http.trusted-proxy-cidrs=${TRUSTED_PROXY_CIDRS:}

#logging.level.root=DEBUG
