# Server Configuration
PORT=8080

# Directory containing the frontend build artifacts
# If running via Docker Compose (as configured), this is set automatically.
# If running locally, this should be relative to the execution directory.
STATIC_DIR=web/dist

# CORS Configuration
# IMPORTANT: Configure this for production to restrict API access
# Format: Comma-separated list of allowed origins
# Examples:
#   Single domain:  CORS_ORIGINS=https://your-domain.com
#   Multiple:       CORS_ORIGINS=https://domain1.com,https://domain2.com
#   With wildcard:  CORS_ORIGINS=https://*.yourdomain.com
#   Development:    CORS_ORIGINS=http://localhost:*,https://localhost:*
#
# Default (if not set): http://localhost:*,https://localhost:* (secure default)
# For public API (allows any origin): CORS_ORIGINS=https://*,http://*
CORS_ORIGINS=https://your-domain.com

# VAPID Configuration
# The email address used as the "sub" claim in the VAPID JWT.
# This must be a valid mailto: link (e.g., mailto:admin@example.com).
# CRITICAL: Set this to a real email address to ensure delivery to iOS devices
# and avoid 403 Forbidden errors from Apple's Push Notification server.
VAPID_SUBJECT=mailto:admin@yourdomain.com

# Message History Configuration
# Number of days to keep message history before automatic cleanup
# Default: 7 days
MESSAGE_RETENTION_DAYS=7

# Cleanup interval in hours
# Default: 24 hours (once a day)
CLEANUP_INTERVAL_HOURS=24

# Prune subscriptions that haven't received a push in this many days
# Default: 30 days
SUBSCRIPTION_RETENTION_DAYS=30

# Topic Key & Proxy Configuration
# Rate limiting for failed topic-key attempts per client IP
# Default: 10 attempts
KEY_VERIFY_MAX_ATTEMPTS=10

# Time window for topic-key rate limiting in minutes
# Default: 15 minutes
KEY_VERIFY_RATE_LIMIT_MINUTES=15

# Comma-separated CIDRs of reverse proxies whose X-Forwarded-For header may
# be trusted for rate limiting (e.g. the Docker network when using the Caddy
# compose service: 172.16.0.0/12).
# Default: empty — X-Forwarded-For is never trusted (recommended when clients
# can reach the server directly)
TRUSTED_PROXIES=

# Admin Panel Configuration
# Password for accessing the admin panel at /admin
# IMPORTANT: Set a strong password for production
# If not set, admin panel will be disabled
# Password is hashed with bcrypt and never stored in plain text
ADMIN_PASSWORD=change-this-secure-admin-password

# Admin session token expiry time in minutes
# Default: 60 minutes (1 hour)
# After this time, admin users will need to login again
ADMIN_TOKEN_EXPIRY_MINUTES=60

# Admin login rate limiting (prevents brute-force attacks)
# Maximum number of failed login attempts before blocking
# Default: 5 attempts
ADMIN_MAX_LOGIN_ATTEMPTS=5

# Time window for rate limiting in minutes
# After this time, failed attempts are cleared
# Default: 15 minutes
ADMIN_LOGIN_RATE_LIMIT_MINUTES=15