who_need_help/config/runtime.exs

import Config

app_role =
  case System.get_env("APP_ROLE", "web") do
    "web" -> :web
    "worker" -> :worker
    "migrate" -> :migrate
    other -> raise "APP_ROLE must be web, worker, or migrate; got #{inspect(other)}"
  end

config :who_need_help,
  app_role: app_role,
  codex_session_id: System.get_env("CODEX_SESSION_ID", "not-configured"),
  map_tile_url:
    System.get_env(
      "MAP_TILE_URL",
      Application.fetch_env!(:who_need_help, :map_tile_url)
    ),
  rate_limit_policies:
    (case System.get_env("RATE_LIMIT_POLICIES_JSON") do
       nil -> %{}
       "" -> %{}
       json -> Jason.decode!(json)
     end)

github_oauth =
  case {
    System.get_env("GITHUB_OAUTH_CLIENT_ID"),
    System.get_env("GITHUB_OAUTH_CLIENT_SECRET")
  } do
    {client_id, client_secret}
    when is_binary(client_id) and client_id != "" and is_binary(client_secret) and
           client_secret != "" ->
      %{
        github: [
          client_id: client_id,
          client_secret: client_secret
        ]
      }

    {client_id, client_secret} when client_id in [nil, ""] and client_secret in [nil, ""] ->
      %{}

    _partial_configuration ->
      raise """
      GITHUB_OAUTH_CLIENT_ID and GITHUB_OAUTH_CLIENT_SECRET must either both be set or both be empty.
      """
  end

config :who_need_help, :social_oauth, github_oauth

if config_env() == :prod and app_role == :web do
  metrics_token =
    System.get_env("METRICS_TOKEN") ||
      raise """
      environment variable METRICS_TOKEN is missing for the web role.
      Generate an independent random value and store it in the deployment secret.
      """

  if metrics_token == "" do
    raise "METRICS_TOKEN must not be empty for the web role."
  end

  config :who_need_help, :metrics_token, metrics_token
end

if dns_query = System.get_env("DNS_CLUSTER_QUERY") do
  config :who_need_help, :dns_cluster_query, dns_query
end

# config/runtime.exs is executed for all environments, including
# during releases. It is executed after compilation and before the
# system starts, so it is typically used to load production configuration
# and secrets from environment variables or elsewhere. Do not define
# any compile-time configuration in here, as it won't be applied.
# The block below contains prod specific runtime configuration.

# ## Using releases
#
# If you use `mix release`, you need to explicitly enable the server
# by passing the PHX_SERVER=true when you start it:
#
#     PHX_SERVER=true bin/who_need_help start
#
# Alternatively, you can use `mix phx.gen.release` to generate a `bin/server`
# script that automatically sets the env var above.
if System.get_env("PHX_SERVER") do
  config :who_need_help, WhoNeedHelpWeb.Endpoint, server: true
end

config :who_need_help, WhoNeedHelpWeb.Endpoint,
  http: [port: String.to_integer(System.get_env("PORT", "4000"))]

if config_env() == :dev do
  # Reload browser tabs when matching files change.
  config :who_need_help, WhoNeedHelpWeb.Endpoint,
    live_reload: [
      web_console_logger: true,
      patterns: [
        # Static assets, except user uploads
        ~r"priv/static/(?!uploads/).*\.(js|css|png|jpeg|jpg|gif|svg)$",
        # Gettext translations
        ~r"priv/gettext/.*\.po$",
        # Router, Controllers, LiveViews and LiveComponents
        ~r"lib/who_need_help_web/router\.ex$",
        ~r"lib/who_need_help_web/(controllers|live|components)/.*\.(ex|heex)$"
      ]
    ]
end

if config_env() == :prod do
  database_url =
    System.get_env("DATABASE_URL") ||
      raise """
      environment variable DATABASE_URL is missing.
      For example: ecto://USER:PASS@HOST/DATABASE
      """

  maybe_ipv6 = if System.get_env("ECTO_IPV6") in ~w(true 1), do: [:inet6], else: []

  config :who_need_help, WhoNeedHelp.Repo,
    # ssl: true,
    url: database_url,
    pool_size: String.to_integer(System.get_env("POOL_SIZE") || "10"),
    # For machines with several cores, consider starting multiple pools of `pool_size`
    # pool_count: 4,
    socket_options: maybe_ipv6

  # The secret key base is used to sign/encrypt cookies and other secrets.
  # A default value is used in config/dev.exs and config/test.exs but you
  # want to use a different value for prod and you most likely don't want
  # to check this value into version control, so we use an environment
  # variable instead.
  secret_key_base =
    System.get_env("SECRET_KEY_BASE") ||
      raise """
      environment variable SECRET_KEY_BASE is missing.
      You can generate one by calling: mix phx.gen.secret
      """

  handover_secret =
    System.get_env("HANDOVER_SECRET") ||
      raise """
      environment variable HANDOVER_SECRET is missing.
      Generate an independent random value for deterministic handover codes.
      """

  host = System.get_env("PHX_HOST") || "example.com"
  scheme = System.get_env("PHX_SCHEME", "https")

  unless scheme in ["http", "https"] do
    raise "PHX_SCHEME must be http or https; got #{inspect(scheme)}"
  end

  default_url_port = if scheme == "https", do: "443", else: "80"
  url_port = String.to_integer(System.get_env("PHX_URL_PORT", default_url_port))

  smtp_auth =
    case System.get_env("SMTP_AUTH", "never") do
      "always" -> :always
      "never" -> :never
      "if_available" -> :if_available
      other -> raise "SMTP_AUTH must be always, never, or if_available; got #{inspect(other)}"
    end

  smtp_tls =
    case System.get_env("SMTP_TLS", "never") do
      "always" -> :always
      "never" -> :never
      "if_available" -> :if_available
      other -> raise "SMTP_TLS must be always, never, or if_available; got #{inspect(other)}"
    end

  smtp_ssl =
    case System.get_env("SMTP_SSL", "false") do
      value when value in ["true", "1"] -> true
      value when value in ["false", "0"] -> false
      other -> raise "SMTP_SSL must be true, false, 1, or 0; got #{inspect(other)}"
    end

  smtp_config =
    [
      adapter: Swoosh.Adapters.SMTP,
      relay: System.get_env("SMTP_RELAY", "mailpit"),
      port: String.to_integer(System.get_env("SMTP_PORT", "1025")),
      auth: smtp_auth,
      tls: smtp_tls,
      ssl: smtp_ssl
    ]
    |> then(fn config ->
      case System.get_env("SMTP_USERNAME") do
        value when is_binary(value) and value != "" -> Keyword.put(config, :username, value)
        _ -> config
      end
    end)
    |> then(fn config ->
      case System.get_env("SMTP_PASSWORD") do
        value when is_binary(value) and value != "" -> Keyword.put(config, :password, value)
        _ -> config
      end
    end)

  config :who_need_help, :handover_secret, handover_secret

  config :who_need_help, :mailer_from,
    name: System.get_env("EMAIL_FROM_NAME", "Who Need Help"),
    address: System.get_env("EMAIL_FROM_ADDRESS", "contact@example.com")

  config :who_need_help, WhoNeedHelp.Mailer, smtp_config

  config :who_need_help, WhoNeedHelpWeb.Endpoint,
    url: [host: host, port: url_port, scheme: scheme],
    http: [
      # Enable IPv6 and bind on all interfaces.
      # Set it to  {0, 0, 0, 0, 0, 0, 0, 1} for local network only access.
      # See the documentation on https://bandit.hexdocs.pm/Bandit.html#t:options/0
      # for details about using IPv6 vs IPv4 and loopback vs public addresses.
      ip: {0, 0, 0, 0, 0, 0, 0, 0}
    ],
    secret_key_base: secret_key_base

  # ## SSL Support
  #
  # To get SSL working, you will need to add the `https` key
  # to your endpoint configuration:
  #
  #     config :who_need_help, WhoNeedHelpWeb.Endpoint,
  #       https: [
  #         ...,
  #         port: 443,
  #         cipher_suite: :strong,
  #         keyfile: System.get_env("SOME_APP_SSL_KEY_PATH"),
  #         certfile: System.get_env("SOME_APP_SSL_CERT_PATH")
  #       ]
  #
  # The `cipher_suite` is set to `:strong` to support only the
  # latest and more secure SSL ciphers. This means old browsers
  # and clients may not be supported. You can set it to
  # `:compatible` for wider support.
  #
  # `:keyfile` and `:certfile` expect an absolute path to the key
  # and cert in disk or a relative path inside priv, for example
  # "priv/ssl/server.key". For all supported SSL configuration
  # options, see https://plug.hexdocs.pm/Plug.SSL.html#configure/1
  #
  # We also recommend setting `force_ssl` in your config/prod.exs,
  # ensuring no data is ever sent via http, always redirecting to https:
  #
  #     config :who_need_help, WhoNeedHelpWeb.Endpoint,
  #       force_ssl: [hsts: true]
  #
  # Check `Plug.SSL` for all available options in `force_ssl`.

  # ## Configuring the mailer
  #
  # In production you need to configure the mailer to use a different adapter.
  # Here is an example configuration for Mailgun:
  #
  #     config :who_need_help, WhoNeedHelp.Mailer,
  #       adapter: Swoosh.Adapters.Mailgun,
  #       api_key: System.get_env("MAILGUN_API_KEY"),
  #       domain: System.get_env("MAILGUN_DOMAIN")
  #
  # Most non-SMTP adapters require an API client. Swoosh supports Req, Hackney,
  # and Finch out-of-the-box. This configuration is typically done at
  # compile-time in your config/prod.exs:
  #
  #     config :swoosh, :api_client, Swoosh.ApiClient.Req
  #
  # See https://swoosh.hexdocs.pm/Swoosh.html#module-installation for details.
end