# IAM (Keycloak externe)
OIDC_ISSUER=https://kc.arauco.online/realms/chiruca
OIDC_AUDIENCE=media-access-api
OIDC_JWKS_URL=https://kc.arauco.online/realms/chiruca/protocol/openid-connect/certs
OIDC_CLIENT_ID=media-access-api
OIDC_CLIENT_SECRET=CHANGE_ME_OIDC_CLIENT_SECRET

# RBAC cumulatif
RBAC_ROLE_PREFIX=media_reader:folder:
RBAC_ROLE_ALL=media_reader:all

# MinIO
MINIO_ROOT_USER=minio
MINIO_ROOT_PASSWORD=CHANGE_ME_MINIO_ROOT_PASSWORD
S3_BUCKET=medias-private
S3_REGION=us-east-1

# API d'acces media
MEDIA_ACCESS_API_IMAGE=ghcr.io/your-org/media-access-api:latest
PRESIGN_TTL_SECONDS=120

# Viewer BFF
VIEWER_BFF_PORT=8082
MEDIA_API_BASE_URL=http://media-access-api:8081
CORS_ALLOWED_ORIGIN=https://photos.arauco.online