# Required
VAULT_MASTER_KEY=change-me-to-a-long-random-string-or-64-hex-chars
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# --- URLs ---
# Local pnpm dev (API :3001, web :5173 — split origins):
PUBLIC_URL=http://localhost:3001
WEB_ORIGIN=http://localhost:5173
VITE_API_URL=http://localhost:3001

# Docker Compose / VPS (nginx proxy on :80 — same origin for UI + API + MCP):
# PUBLIC_URL=http://YOUR_SERVER_IP
# WEB_ORIGIN=http://YOUR_SERVER_IP
# VITE_API_URL=
# When you add a domain + TLS later:
# PUBLIC_URL=https://vaultmcp.example.com
# WEB_ORIGIN=https://vaultmcp.example.com
# VITE_API_URL=
# COOKIE_SECURE=true

# Database / cache (host ports when using compose postgres/redis from the host)
# Compose requires POSTGRES_PASSWORD; keep it in sync with DATABASE_URL.
POSTGRES_PASSWORD=change-me-to-a-long-random-password
DATABASE_URL=postgres://vaultmcp:change-me-to-a-long-random-password@localhost:5432/vaultmcp
REDIS_URL=redis://localhost:6379

# API
PORT=3001
NODE_ENV=development
SESSION_COOKIE_NAME=vaultmcp_session
COOKIE_SECURE=false
RATE_LIMIT_WINDOW_MS=60000
RATE_LIMIT_MAX=120