# Copy to .env and edit. Nothing here is secret except OBSCURA_METRICS_TOKEN — this server holds no
# secret it could leak, which is rather the point.

# Where the console is served from. Must match exactly, including scheme and port, or the browser
# blocks the API calls. Comma-separate to allow more than one.
OBSCURA_ORIGIN=http://localhost:8787

# WebAuthn relying-party id: the registered domain, without scheme or port. Passkeys are bound to
# it, so changing it later invalidates every enrolled passkey.
OBSCURA_RP_ID=localhost

# Set to 1 when something in front terminates TLS. Enables HSTS.
OBSCURA_BEHIND_TLS=0

# Set to 1 ONLY when a proxy you control sets X-Forwarded-For. Otherwise the header is
# attacker-controlled and anyone can bypass per-IP rate limiting by spoofing it.
OBSCURA_TRUST_PROXY=0

# debug | info | warn | error
OBSCURA_LOG_LEVEL=info

# Leave empty to expose /v1/metrics without auth (fine on a private network); set a random string
# to require it as a bearer token.
OBSCURA_METRICS_TOKEN=

# Google OAuth client id for Drive and the Photos picker. Create one at
# https://console.cloud.google.com — an OAuth 2.0 Client ID of type "Web application", with this
# deployment's origin as an authorised JavaScript origin.
#
# Request the drive.file scope ONLY. It is non-restricted; `drive` and `drive.readonly` are
# restricted and trigger an annual third-party CASA security assessment. See docs/RESEARCH.md §1.2.
#
# There is no client *secret* here, and there must not be: the console is a public client using
# PKCE, and a secret shipped to a browser is not a secret.
VITE_GOOGLE_CLIENT_ID=