.env.example

# ============================================
# RequestRepo Configuration
# ============================================
# Copy this file to .env and customize for your environment
# Frontend variables must be prefixed with VITE_ to be exposed to the browser

# === REQUIRED - Change these! ===
JWT_SECRET=your-super-secret-jwt-key-change-this-min-32-chars
DOMAIN=localhost
SERVER_IP=127.0.0.1
# Optional. Address returned for AAAA queries with no user-defined record.
# Leave empty to keep the zone IPv4-only.
SERVER_IPV6=

# === Frontend (Vite) - Development Only ===
# Uncomment these for local development (bun dev / make start-frontend)
# Production/Docker builds use runtime detection - do NOT set these for Docker
# VITE_DOMAIN=localhost
# VITE_HTTP_PORT=21337

# === Server Ports ===
HTTP_PORT=80
DNS_PORT=53
SMTP_PORT=25
HTTPS_PORT=443

# === TCP Port Range (for custom TCP listeners) ===
TCP_PORT_RANGE_START=10000
TCP_PORT_RANGE_END=10100

# === Subdomain Configuration ===
SUBDOMAIN_LENGTH=8
SUBDOMAIN_ALPHABET=abcdefghijklmnopqrstuvwxyz0123456789
INCLUDE_SERVER_DOMAIN=true

# === Default DNS TXT Record ===
TXT=Hello!

# === Rate Limiting ===
# Max sessions per IP per time window
SESSION_RATE_LIMIT=10
SESSION_RATE_WINDOW_SECS=60

# === Cache/Memory Configuration ===
# Per-subdomain storage limit (files + DNS records)
MAX_SUBDOMAIN_SIZE_MB=10
# Max HTTP request body size
MAX_REQUEST_BODY_MB=10
# Max cache memory as % of container limit (0.7 = 70%, or use 70)
CACHE_MAX_MEMORY_PCT=70

# === Admin Token (optional) ===
# If set, session creation requires this token via:
# - Request body: {"admin_token": "..."}
# - HTTP-only cookie (set automatically after first successful auth)
# When enabled, users see a password overlay on first visit
# ADMIN_TOKEN=your-admin-token

# === TLS/HTTPS Configuration (optional) ===
TLS_ENABLED=false
CERT_DIR=./certs
# ACME_EMAIL=your-email@example.com
# ACME_DIRECTORY=https://acme-v02.api.letsencrypt.org/directory
# Use staging for testing: https://acme-staging-v02.api.letsencrypt.org/directory
CERT_RENEWAL_DAYS=30
CERT_CHECK_HOURS=12
# IP address certificate (short-lived, 6-day via HTTP-01)
# IP_CERT_ENABLED=false
# IP_CERT_CHECK_HOURS=6
# IP_CERT_RENEWAL_HOURS=96

# === Security ===
# Serve user-controlled content at /r/<subdomain> on the dashboard origin.
# This is useful for domainless/IP deployments, but weakens origin isolation.
DANGEROUSLY_ALLOW_SAME_ORIGIN_USER_CONTENT=false
# Allow origin-scoped headers such as Service-Worker-Allowed and Alt-Svc on /r/ routes.
# Has no effect unless same-origin user content is enabled above.
DANGEROUSLY_ALLOW_ALL_HEADERS=false

# === Error Tracking (Sentry) ===
# SENTRY_DSN_BACKEND=https://xxx@sentry.io/xxx
# SENTRY_DSN_FRONTEND=https://xxx@sentry.io/xxx

# === Logging ===
# Rust log level: trace, debug, info, warn, error
RUST_LOG=info