# GoblinPay environment. Copy to /etc/goblinpay.env (bare metal) or deploy/.env
# (docker compose), then edit. NON-SECRET config only: the Grin seed and the
# wallet password live as separate files (a systemd credential / the compose
# ./secrets mount), never in this file.
#
# SECURITY: never put GP_MNEMONIC or GP_WALLET_PASSWORD (the seed and the key
# that decrypts it) inline in this file or the environment. An inline env var is
# readable by the whole process and, via /proc, by root for the life of the
# service; the server prints a loud deprecation warning if you do. Deliver them
# as files (GP_MNEMONIC_FILE / GP_WALLET_PASSWORD_FILE) or a systemd credential.
#
# The recommended path is `gp-server setup`, which has YOU choose the wallet
# password (entered twice, grin-wallet-faithful; never auto-generated), shows a
# fresh 24-word seed once for you to write down (or takes your recovery phrase),
# and asks how the till should restart: UNATTENDED (default) or MANUAL. In
# UNATTENDED mode the password is sealed to this host with `systemd-creds encrypt`
# (ENCRYPTED at rest, decrypted at each start) so the service auto-restarts with
# no plaintext key on disk; MANUAL keeps nothing on disk and you re-enter it after
# every restart. This file is the by-hand path.

# --- domain / URLs ---
# docker-compose serves GoblinPay on GP_DOMAIN and the bundled relay on
# relay.<GP_DOMAIN>; point BOTH DNS records at this host before `compose up`.
GP_DOMAIN=pay.example
GP_PUBLIC_URL=https://pay.example

# --- relay (bundled is the default: GoblinPay runs its own relay) ---
GP_RELAY_MODE=bundled
# The bundled relay's PUBLIC url: it is BOTH dialed by the server AND advertised
# to payers in the checkout nprofile, so it must be reachable from the internet.
GP_BUNDLED_RELAY_URL=wss://relay.pay.example
# For GP_RELAY_MODE=external instead, drop the bundled relay and set:
#GP_RELAY_MODE=external
#GP_RELAYS=wss://relay.damus.io,wss://nos.lol

# --- Grin node (read-only: confirmations + balance) ---
GP_NODE_URL=https://main.gri.mw

# --- API / admin tokens (bearer capabilities; use strong random values) ---
GP_API_TOKEN=change-me-api-token
GP_ADMIN_TOKEN=change-me-admin-token

# --- webhook to your store (optional; the URL requires the secret) ---
#GP_WEBHOOK_URL=https://your-store/hook
#GP_WEBHOOK_SECRET=change-me-webhook-secret

# --- default payment-matching mode: memo | derived | amount ---
GP_MATCH_MODE=derived

# --- grin1 / Tor rail (operator opt-in; PACKAGED DEFAULT OFF) ---
# When off (or unset) GoblinPay is Goblin/Nostr-only: no Tor onion service, no
# local Foreign API listener, and the pay page shows only "Pay with Goblin".
# Set to `on` to also accept payments from ANY Grin wallet over Tor: the till
# publishes an onion service whose identity IS its grin1 slatepack address key
# (grin1 address == onion address), serving the Grin Foreign API v2.
#GP_GRIN1_RAIL=on
# Loopback port the Foreign API binds (the onion service proxies to it).
#GP_GRIN1_FOREIGN_PORT=3416