# {{PROJECT_NAME}} — staging compose environment (copy to staging.env; never commit secrets).
#
#   cp ops/compose/staging.env.example ops/compose/staging.env
#
# WHAT BELONGS HERE vs. WHAT IS DERIVED
# -------------------------------------
# The per-worktree host ports, compose project name, and subnet are DERIVED at runtime by
# scripts/ops/staging-env.sh (sourced by the Makefile staging targets) — do NOT hardcode
# them here. Source that script to see them:
#
#   eval "$(env | grep -q . ; :)"; source scripts/ops/staging-env.sh
#   #   COMPOSE_PROJECT_NAME   e.g. {{PROJECT_NAME}}-wt-<hash>   (shared checkout: {{PROJECT_NAME}})
#   #   STAGING_OFFSET         1..254
#   #   STAGING_SUBNET         10.<offset>.0.0/16
#   #   PORT_<SERVICE>         per-service host port (band + offset; shared: fixed)
#
# This file is ONLY for values staging-env.sh cannot derive — anything that embeds a port or
# host by hand and therefore has to be kept in step with the resolved ports. When you change
# the resolved ports (or move between the shared and a per-worktree stack), update the URLs
# below to match. staging-env.sh prints a one-line warning if it spots a stale `:<port>` here.

# --- CORS: browser origin allowlist (services reject cross-origin requests outside this list) ---
# Comma-separated. Must include the host:PORT_<SERVICE> your browser actually hits. Example for a
# frontend served from the derived UI port:
#   ALLOWED_ORIGINS=http://localhost:${PORT_WEB},http://127.0.0.1:${PORT_WEB}
ALLOWED_ORIGINS=

# --- Email-link / callback base URLs (baked into links the app emits — keep in step with ports) ---
# Example:
#   EMAIL_LINK_BASE_URL=http://localhost:${PORT_WEB}

# --- Any other non-derived, port-bearing values go here, one KEY=value per line. ---