{
  "ConnectionStrings": {
    "SqlServer": "Server=87.107.152.16,1433;Database=Baya;User Id=hamid_root_un_sa;Password=N8@s5Taw1zWeh@#Hm;TrustServerCertificate=True;Encrypt=False;",
    "logDb": "Server=87.107.152.16,1433;Database=Baya_Logs;User Id=hamid_root_un_sa;Password=N8@s5Taw1zWeh@#Hm;TrustServerCertificate=True;Encrypt=False;"
  },
  "IdentitySettings": {
    "SecretKey": "dev-only-jwe-signing-key-not-for-production-0123456789abcdef",
    "Encryptkey": "dev-only-16bytes",
    "Issuer": "Balinyaar",
    "Audience": "BalinyaarClient",
    "NotBeforeMinutes": "0",
    "ExpirationMinutes": "60"
  },
  "Seams": {
    "FieldEncryption": {
      "//": "DO NOT CHANGE. Every encrypted column in the Baya database (phones, addresses, IBANs, clinical notes) was written with these exact values, and users.PhoneHash — which every login looks up — is derived from HashKey. Rotating either makes the existing data unreadable and locks every account out.",
      "Key": "local-dev-field-encryption-key-not-for-production",
      "HashKey": "local-dev-field-hash-key-not-for-production"
    },
    "ObjectStorage": {
      "RootPath": ""
    },
    "Sms": {
      "Provider": "telegram",
      "Telegram": {
        "BaseUrl": "http://127.0.0.1:5010",
        "//": "Must equal the relay's API_KEY. NOT the value in telegram-otp-bot/.env.example — that one is published, so TelegramSmsSender rejects it.",
        "ApiKey": "6a8dfaeea1aa375eb61da7663cadf23a3ea245fd939264dd",
        "TimeoutSeconds": 10
      }
    },
    "Geocoding": {
      "ReturnNullCoordinates": false,
      "LowConfidenceMarker": "NO_GEO",
      "ResolvedConfidence": 0.9
    }
  },
  "Cors": {
    "AllowedOrigins": [
      "https://balinyaar.ir",
      "https://www.balinyaar.ir",
      "http://localhost:3000"
    ]
  },
  "ForwardedHeaders": {
    "//": "Docker bridge ranges — the reverse proxy (Caddy) shares a container network with the API, so its hop must be trusted for X-Forwarded-For to resolve the real client IP the rate limiter partitions on.",
    "KnownProxies": [],
    "KnownNetworks": [
      "172.16.0.0/12",
      "192.168.0.0/16",
      "10.0.0.0/8"
    ]
  },
  "AllowedHosts": "*",
  "Kestrel": {
    "EndpointDefaults": {
      "Protocols": "Http1AndHttp2"
    }
  }
}