# =============================================================================
# 1. 最小必填 / Minimum required
# =============================================================================

# Keeper 服务端访问 CPA 的地址。Docker Compose 内通常是 http://cli-proxy-api:8317。必填：是。默认值：无。
# URL used by the Keeper server to call CPA. In Docker Compose this is usually http://cli-proxy-api:8317. Required: yes. Default: none.
CPA_BASE_URL=http://127.0.0.1:8317

# CPA management key，用于拉取管理接口数据。必填：是。默认值：无。
# CPA management key used to access management endpoints. Required: yes. Default: none.
CPA_MANAGEMENT_KEY=replace-with-your-management-key


# =============================================================================
# 2. Web 访问与反代 / Web access and reverse proxy
# =============================================================================

# HTTP 服务监听端口。必填：否。默认值：8080。
# HTTP listen port for the application. Required: no. Default: 8080.
APP_PORT=8080

# Keeper 部署子路径；留空表示部署在根路径 /。如需子路径，必须以 / 开头，例如 /keeper；/keeper/ 会规范为 /keeper。
# Keeper subpath prefix; leave empty to serve from /. For subpath deployment, start with /, for example /keeper; /keeper/ is normalized to /keeper.
APP_BASE_PATH=

# 浏览器访问 CPA 的公开地址，用于“返回 CPA”跳转。留空时使用当前页面同源根路径并追加 /management.html。
# Public CPA URL for the "Back to CPA" link. When empty, the current page origin is used and /management.html is appended.
CPA_PUBLIC_URL=


# =============================================================================
# 3. 登录保护 / Login protection
# =============================================================================

# 是否启用登录保护。公网部署建议设为 true。必填：否。默认值：false。
# Whether to enable login protection. Recommended for public deployments. Required: no. Default: false.
AUTH_ENABLED=false

# 登录密码；仅在启用登录保护时必填。默认值：无。
# Login password; required only when login protection is enabled. Default: none.
LOGIN_PASSWORD=replace-with-your-login-password

# 登录 session 的有效时长。必填：否。默认值：168h。
# Lifetime of the login session. Required: no. Default: 168h.
AUTH_SESSION_TTL=168h


# =============================================================================
# 4. 时区与请求行为 / Timezone and request behavior
# =============================================================================

# 项目业务时区，影响 Today、按天聚合、页面时间、日志时间和每日清理时间。必填：否。默认值：Asia/Shanghai。
# Project business timezone. Affects Today, daily aggregation, page timestamps, log timestamps, and daily cleanup. Required: no. Default: Asia/Shanghai.
TZ=Asia/Shanghai

# 请求 CPA HTTP 接口和 Redis 队列的超时时间。必填：否。默认值：30s。
# Timeout for CPA HTTP requests and Redis queue operations. Required: no. Default: 30s.
REQUEST_TIMEOUT=30s

# 是否跳过 CPA HTTPS 和 Redis 队列 TLS 的证书验证；仅在使用自签名证书时启用。必填：否。默认值：false。
# Whether to skip TLS certificate verification for CPA HTTPS and Redis queue TLS connections; enable only with self-signed certificates. Required: no. Default: false.
TLS_SKIP_VERIFY=false


# =============================================================================
# 5. Auth Files 限额刷新 / Auth Files quota refresh
# =============================================================================

# Auth Files 限额刷新队列的最大并发数，手动刷新和定时刷新共用，最大 100。调大可以更快刷新大量账号，但也会增加上游限流和本地 SQLite 读压力。必填：否。默认值：10。
# Maximum concurrency for the shared Auth Files quota refresh queue used by both manual and scheduled refresh, capped at 100. Increase it to refresh many accounts faster, but it may raise upstream rate-limit and local SQLite read pressure. Required: no. Default: 10.
QUOTA_REFRESH_WORKER_LIMIT=10


# =============================================================================
# 6. Redis 队列高级配置 / Redis queue advanced settings
# =============================================================================

# CPA management data stream 的 Redis/RESP TCP 地址。留空时默认使用 CPA_BASE_URL 的主机名加 8317 端口；非默认端口或单独暴露 Redis stream 时填写 host:port。
# Redis/RESP TCP address for the CPA management data stream. When empty, defaults to the CPA_BASE_URL hostname plus port 8317; set host:port for non-default ports or separately exposed Redis streams.
REDIS_QUEUE_ADDR=

# 是否使用 TLS 连接 Redis 队列；显式设置 REDIS_QUEUE_ADDR 且需要 TLS 时设为 true。必填：否。默认值：false。
# Whether to use TLS for the Redis queue connection; set true when REDIS_QUEUE_ADDR is explicit and requires TLS. Required: no. Default: false.
REDIS_QUEUE_TLS=false

# 每次 Redis LPOP 最多拉取的队列记录数。必填：否。默认值：10000。
# Maximum queue records per Redis LPOP. Required: no. Default: 10000.
REDIS_QUEUE_BATCH_SIZE=10000

# Redis 队列为空时的 idle 检查间隔。必填：否。默认值：1s。
# Idle check interval when the Redis queue is empty. Required: no. Default: 1s.
REDIS_QUEUE_IDLE_INTERVAL=1s


# =============================================================================
# 7. 存储、日志与备份 / Storage, logs, and backups
# =============================================================================

# 应用工作目录，SQLite 数据库、日志和备份默认都写入这里。Docker 中 ./data 对应 /data；二进制中相对路径按 .env 所在目录解析。必填：否。默认值：./data。
# Application work directory. SQLite database, logs, and backups are stored here by default. In Docker ./data maps to /data; for binaries, relative paths are resolved against the .env file directory. Required: no. Default: ./data.
WORK_DIR=./data

# 应用日志级别。必填：否。默认值：info。
# Application log level. Required: no. Default: info.
LOG_LEVEL=info

# 是否写入持久化日志文件。必填：否。默认值：true。
# Whether to write persistent log files. Required: no. Default: true.
LOG_FILE_ENABLED=true

# 日志文件保留天数；0 表示不自动清理。必填：否。默认值：7。
# Number of days to retain log files; 0 disables cleanup. Required: no. Default: 7.
LOG_RETENTION_DAYS=7

# 是否在每日维护中删除过期 usage_events 原始事件；默认不清理，设为 true 后会删除上个月 1 日 00:00 之前的数据。必填：否。默认值：false。
# Whether daily maintenance deletes expired raw usage_events; disabled by default. When true, rows before 00:00 on the first day of the previous month are deleted. Required: no. Default: false.
CLEANUP_USAGE_EVENTS_ENABLED=false

# 是否启用 SQLite 数据库备份。必填：否。默认值：true。
# Whether to enable SQLite database backups. Required: no. Default: true.
BACKUP_ENABLED=true

# 数据库备份间隔。必填：否。默认值：24h。
# Database backup interval. Required: no. Default: 24h.
BACKUP_INTERVAL=24h

# 备份文件保留天数。必填：否。默认值：7。
# Number of days to retain backup files. Required: no. Default: 7.
BACKUP_RETENTION_DAYS=7


# =============================================================================
# 8. 内置 HTTPS / Built-in HTTPS
# =============================================================================

# 是否让 Keeper 进程直接启用 HTTPS/TLS。通常建议在反向代理层处理 HTTPS。必填：否。默认值：false。
# Whether Keeper should serve HTTPS/TLS directly. Usually HTTPS should be terminated at the reverse proxy. Required: no. Default: false.
TLS_ENABLED=false

# HTTPS 证书文件路径。启用 TLS 时必填。支持相对 .env 所在目录的路径。默认值：无。
# HTTPS certificate file path. Required when TLS is enabled. Relative paths are resolved against the .env file directory. Default: none.
TLS_CERT_FILE=

# HTTPS 私钥文件路径。启用 TLS 时必填。支持相对 .env 所在目录的路径。默认值：无。
# HTTPS private key file path. Required when TLS is enabled. Relative paths are resolved against the .env file directory. Default: none.
TLS_KEY_FILE=