PORT=8787
ROOM_TTL_MINUTES=360
ATTACHMENT_MAX_MB=25
ROOM_ATTACHMENT_MAX_MB=100
ALLOWED_ORIGINS=https://chat.example.com
PUBLIC_ORIGIN=https://chat.example.com
GUEST_REDIRECT_URL=https://example.com/
HOST_AUTH_SECRET=replace-with-a-long-random-secret
HOST_PASSWORD=
TRUST_DB=./trusted-devices.json
HOST_PUSH_FILE=./host-push.json

# Optional companion service for host device approval
GAFBOX_URL=
GAFBOX_SHARED_SECRET=

# Optional direct PWA push notifications; generate your own VAPID key pair
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=https://chat.example.com


# Practical hardening defaults. Keep state paths outside the app for a read-only service.
BIND_HOST=127.0.0.1
ROOM_MAX_AGE_MINUTES=360
HOST_SESSION_DAYS=30
TRUSTED_DEVICE_DAYS=90
MAX_ROOMS=16
MAX_ROOM_MEMBERS=16
MAX_CONNECTIONS=128
MAX_CONCURRENT_UPLOADS=2
TOTAL_ATTACHMENT_MAX_MB=256