# Sample environment file. Copy to .env and fill in values.
# All variables use the MT_ prefix (loaded by pydantic-settings).

# --- Required ---

# TimescaleDB connection URL (PostgreSQL with TimescaleDB extension).
# This is the *application* credential: DML only. The daemon, API server, and
# every CLI read path use it. A leak of this URL cannot TRUNCATE, DROP, or
# write the migration ledger.
MT_TIMESCALE_DB_URL=postgresql://user:password@host:5432/trading

# Migration/maintenance credential — DDL rights. Needed ONLY by schema and
# maintenance commands: `mt data migrate apply`, `mt data init`,
# `mt data rechunk`, `mt data caggs repair`, `mt data caggs refresh`, and
# `mt data restore run`. Leave unset for normal operation; those commands fail
# loudly naming this variable rather than silently falling back to the
# application URL. Provision both roles with scripts/provision_roles.sql.
# MT_TIMESCALE_MAINTENANCE_URL=postgresql://trading_migrate:password@host:5432/trading

# EODHD API token — used for all data acquisition and universe rebuild.
MT_EODHD_API_KEY=your-eodhd-api-key

# --- Recommended ---

# Finnhub API token — used for IPO-date enrichment during instruments rebuild.
# Without this, first_listing_date will not be populated.
MT_FINNHUB_API_KEY=your-finnhub-api-key

# --- Optional ---

# Log level: DEBUG, INFO (default), WARNING, ERROR
# MT_LOG_LEVEL=INFO

# Minute data provider (default: eodhd)
# MT_MINUTE_PROVIDER=eodhd

# Daily data provider (default: eodhd)
# MT_DAILY_PROVIDER=eodhd

# Daily API credit cap for EODHD (default: 100000)
# MT_EODHD_DAILY_LIMIT=100000

# --- Backup / offsite (slice 915) ---

# Backblaze B2, used via its S3-compatible API so rclone/aws tooling works
# unchanged. S3 variable names rather than B2-specific ones, so the target can
# change without touching the scripts.
#
# Create a bucket-scoped application key, NOT the account master key: the master
# key can delete every bucket in the account, while a scoped key is bound to one
# bucket at creation and cannot be widened afterward. Same reasoning as the
# least-privilege database roles in slice 913.
#
# The application key is displayed exactly once, at creation — it cannot be
# retrieved later. If lost, delete the key and create a new one.
#
# The endpoint is region-specific; the region fragment (e.g. us-west-004) is
# assigned when the bucket is created. A wrong region fails as an auth error
# rather than a routing error, which is a misleading way to spend an hour.
#
# The bucket holds a full database copy and must be private.
# MT_BACKUP_S3_ENDPOINT=https://s3.us-west-004.backblazeb2.com
# MT_BACKUP_S3_KEY_ID=your-b2-key-id
# MT_BACKUP_S3_APPLICATION_KEY=your-b2-application-key
# MT_BACKUP_S3_BUCKET=your-bucket-name

# --- Test / CI ---

# Admin connection URL for the integration and load tiers. The ephemeral_db /
# migrated_db fixtures use it to CREATE and DROP throwaway databases, so it
# points at the `postgres` maintenance database, never the application database.
#
# Use `trading_test_admin` — a role holding LOGIN CREATEDB and nothing else —
# not a superuser. The fixtures need only database create/drop; a superuser here
# can reach production by swapping the database name in this URL, which is
# precisely what `swap_dbname` does. Provision the role with
# scripts/provision_roles.sql; test/integration/data/test_test_admin_role.py
# fails if this is repointed at a superuser.
# MT_TIMESCALE_TEST_URL=postgresql://trading_test_admin:password@host:5432/postgres
