# Database
DATABASE_URL=postgres://bookorbit:bookorbit@localhost:5432/bookorbit

# App
PORT=3000
NODE_ENV=development

# API docs (optional)
# Set to true to serve Swagger UI at /api/docs and OpenAPI JSON at /api/docs-json.
# SWAGGER_ENABLED=false

# Auth
JWT_SECRET=change-me-in-production
JWT_EXPIRES_IN=15m
JWT_REFRESH_EXPIRES_IN=7d
# Required in production for initial /auth/setup (x-setup-token header)
SETUP_BOOTSTRAP_TOKEN=

# Storage
# App data directory for covers, author images, user avatars, and cache.
# This path resolves relative to server/ (where the process runs).
# ../local/data points to <project-root>/local/data.
APP_DATA_PATH=../local/data

# Top of the library creation folder picker. Defaults to / when unset.
# Set this to the server-visible folder where users should create libraries.
# LIBRARY_BROWSE_ROOT=../local/books

# File write scheduler and concurrency tuning (optional)
# FILE_WRITE_DEBOUNCE_MS=3000
# FILE_WRITE_MAX_CONCURRENT_WRITES=2

# KOReader plugin source folder served by the preconfigured plugin download (optional).
# Defaults to <project-root>/koreader-plugin/bookorbit.koplugin in dev; the Docker image sets it.
# KOREADER_PLUGIN_PATH=../koreader-plugin/bookorbit.koplugin

# Optional: allow Cloudflare Web Analytics beacon in CSP when automatic setup is enabled.
# Keep unset/false to preserve strict CSP (`script-src 'self'`).
# CSP_ALLOW_CLOUDFLARE_INSIGHTS=false

# OIDC (optional — configure via admin settings UI; these are just for reference)
# OIDC config is stored in the database (app_settings table, key: oidc_config)

# OIDC runtime tuning (optional — uncomment to override defaults)
# OIDC_STATE_TTL_SECS=600
# OIDC_DISCOVERY_CACHE_TTL_SECS=3600
# OIDC_JWKS_CACHE_TTL_SECS=3600
# OIDC_CLOCK_TOLERANCE_SECS=30
# OIDC_TOKEN_EXCHANGE_TIMEOUT_MS=10000
# Allow OIDC issuer/discovery URLs that resolve to private/local addresses in production.
# Default false. Keep false unless you intentionally trust your private network.
# OIDC_ALLOW_LOCAL_ISSUERS=false

# App URL (used for building password reset links in emails)
APP_URL=http://localhost:5173

# Email encryption key (optional but recommended — 64-char hex string for AES-256)
# Generate with: openssl rand -hex 32
# EMAIL_ENCRYPTION_KEY=

# Migration encryption key (optional but recommended — 64-char hex string for AES-256)
# Encrypts source connection config (database passwords) at rest.
# Generate with: openssl rand -hex 32
# MIGRATION_ENCRYPTION_KEY=

# SMTP for system emails (password reset) is configured via the admin UI,
# not via environment variables.