# Concise — Docker environment template.
# Copy to .env, edit, then: docker compose up -d --build
# Every value is optional; an uncommented line overrides the app's default.
#
# NOTE: this file is for the hardened docker-compose stack, which runs as a
# fixed non-root user (user: "1000:1000" in docker-compose.yml). The image's
# PUID/PGID/UMASK variables only take effect when the container starts as root
# (NAS platforms like Unraid) — see unraid/ for that deployment. They are
# ignored here.

# Host port to publish. The container always listens on 3000 internally.
PORT=3000

# Session lifetime in hours (default 336 = 14 days).
SESSION_TTL_HOURS=336

# Secure cookies (the production default) are only sent over HTTPS — serve
# Concise behind a TLS-terminating reverse proxy (Caddy, nginx, Traefik) and
# leave this commented out. ONLY for local plain-HTTP testing on loopback
# (e.g. http://localhost:3000) uncomment the line below, or login will appear
# to do nothing. Never run COOKIE_SECURE=false on a network-exposed instance.
# COOKIE_SECURE=false

# Behind a reverse proxy (nginx, Traefik, Caddy, …) set the number of proxy
# hops to trust so client IPs used for rate limiting and the audit log are
# correct. Typically 1 for a single proxy. Leave 0 when exposed directly.
TRUST_PROXY=0

# Extra origins the CSRF check should trust, comma-separated. Only needed if
# the frontend is served from a different origin than the API.
# Example: TRUSTED_ORIGINS=https://money.example.com
TRUSTED_ORIGINS=

# Rate limits.
API_RATE_LIMIT=300       # API requests per IP per minute
LOGIN_RATE_LIMIT=10      # login attempts per IP per 15 minutes

# Set to 1 to (re)seed the demo account on startup
# (username: demo / password: demo). Leave 0 for real deployments.
SEED_ON_START=0

# Log verbosity (structured JSON to stdout — read with `docker logs`). One of
# fatal, error, warn, info, debug, trace, silent. Default info. Use debug to
# see liveness health-check polls and per-request detail.
# LOG_LEVEL=info

# Price source for market-valued holdings. 'real' (default) fetches live quotes
# from Yahoo Finance over the network — no API key. Set to 'simulated' for an
# air-gapped/offline deployment, which uses a deterministic built-in simulation
# instead (prices will not match the real market).
# PRICE_PROVIDER=real;

# Where database backups are written. Defaults to a backups/ folder next to the
# database (i.e. /data/backups in the container), so backups persist on the same
# volume. Backup behaviour (schedule, retention, name) is configured in-app under
# Settings → Backup; automatic backups are on by default. See BACKUP.md.
# BACKUP_DIR=/data/backups