import Config

# Runtime configuration — read from environment variables at boot.
# This file is evaluated at runtime, not compile time.
# Required for OTP releases where env vars aren't known at build time.

if config_env() == :prod do
  # L3 — PostgreSQL connection
  # The kohen sets DATABASE_URL in the K8s secret
  database_url =
    System.get_env("DATABASE_URL") ||
      raise """
      DATABASE_URL not set.
      The kohen must set the DATABASE_URL in shorashim-secrets.
      Format: ecto://user:password@host:port/database?sslmode=require
      """

  config :vav_pipeline, VavPipeline.Repo,
    url: database_url,
    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "20"),
    ssl: true,
    ssl_opts: [verify: :verify_none]

  # L1 mount point — overridable via env
  config :vav_pipeline,
    l1_mount_point: System.get_env("L1_MOUNT_POINT") || "/mnt/torah",
    mesorah_mount_point: System.get_env("MESORAH_MOUNT_POINT") || "/mnt/mesorah",
    manna_provision_file:
      System.get_env("MANNA_PROVISION_FILE") || "/var/lib/bikoret/manna/today.json",
    talmudic_socket_path:
      System.get_env("TALMUDIC_SOCKET_PATH") || "/tmp/bikoret/talmudic.sock",
    korban_socket_path:
      System.get_env("KORBAN_SOCKET_PATH") || "/tmp/bikoret/korban.sock",
    # The keys themselves are in the file (a mounted Secret), not in env.
    api_keys_file: System.get_env("API_KEYS_FILE") || "/etc/bikoret/secrets/api_keys",
    # The ingress controller's network: only from there is X-Real-IP the
    # caller's address (BigdeiKodesh.Mishmar.peer/1). Comma-separated CIDRs.
    trusted_proxies:
      (System.get_env("TRUSTED_PROXIES") || "")
      |> String.split(",", trim: true)
      |> Enum.map(&String.trim/1),
    # Shoresh Engine binary — VavPipeline.ShoreshEnginePort opens an
    # Erlang Port with {:spawn_executable, binary}, which spawns a CHILD
    # PROCESS OF THIS CONTAINER. A Port cannot cross a container
    # boundary, so the Haskell binary has to be on this container's
    # filesystem, not only in the shoresh-engine image. deployment.yaml
    # stages it onto a shared volume with an init container and points
    # this variable at it. Without the override, Application.
    # maybe_add_shoresh_port/3 finds nothing on PATH and logs
    # "running without Haskell engine" — the system comes up DEGRADED
    # and says so only in a warning line.
    shoresh_engine_binary:
      System.get_env("SHORESH_ENGINE_BINARY") || "shoresh-engine",
    http_port: String.to_integer(System.get_env("HTTP_PORT") || "4000")
end