# API server port
PORT=5000

# Database connection string (PostgreSQL)
DATABASE_URL=postgresql://patchpass:patchpass@db:5432/patchpass

# Domain name for cookie scoping (e.g. patchpass.example.com or localhost)
DOMAIN=localhost

# Public UI URL
UI_URL=http://localhost:5000

# API URL the UI connects to (leave same-origin in production)
REACT_APP_API_URL=http://localhost:5000

# Comma-separated list of allowed CORS origins
CORS_URLS=http://localhost:5000,http://localhost:3000

# Rate limit window in milliseconds (0 disables the global RJWEB ratelimiter)
RATELIMIT=1000

# Instance secret — used to sign approval receipts (HMAC-SHA256) and hash sessions.
# Must be a random 32-byte hex string. Generate with: openssl rand -hex 32
INSTANCE_SECRET=changeme_replace_with_a_random_32_byte_hex_string

LOG_LEVEL=info
REQUEST_DEBUGGING=false
RESPONSE_DEBUGGING=false