# Public URLs
NEXT_PUBLIC_APP_URL=http://localhost:3000
NEXT_PUBLIC_REALTIME_URL=http://localhost:3001
NEXT_PUBLIC_PORTAL_DEMO_MODE=false
PORTAL_DEMO_MODE=false
WEB_PORT=3000
REALTIME_PORT=3001

# Database
POSTGRES_USER=igwak
POSTGRES_PASSWORD=replace-with-a-long-random-password
POSTGRES_DB=igwak
DATABASE_URL=postgresql://igwak:replace-with-a-long-random-password@localhost:5432/igwak?schema=public

# Authentication - generate independent random values of at least 32 bytes
SESSION_SECRET=replace-with-a-random-64-character-value
PORTAL_ENCRYPTION_KEY=replace-with-a-different-random-64-character-value
INTERNAL_API_SECRET=replace-with-a-third-random-64-character-value
ADMIN_INITIAL_ID=admin
ADMIN_INITIAL_PASSWORD=replace-before-first-start
ADMIN_INITIAL_NICKNAME=하태욱
# Korean Tailscale Riroschool bridge. OFF preserves portal login but disables direct registration, re-verification, and recovery.
RIRO_AUTH_MODE=OFF
RIRO_BRIDGE_URL=http://100.85.99.14:8765
# Independent random value shared only by the portal and bridge (openssl rand -hex 32)
RIRO_BRIDGE_SECRET=
TRUST_PROXY=false

# Object storage
S3_ENDPOINT=http://localhost:9000
S3_BUCKET=igwak-uploads
S3_ACCESS_KEY=igwak-storage
S3_SECRET_KEY=replace-with-a-long-random-password
S3_REGION=auto

# Optional Web Push
VAPID_PUBLIC_KEY=
VAPID_PRIVATE_KEY=
VAPID_SUBJECT=mailto:admin@example.invalid
# Optional exact hostnames for a private standards-compliant Web Push service.
# Public browser push providers are already allowlisted.
PUSH_ENDPOINT_HOSTS=
OUTBOX_ENABLED=false
OUTBOX_POLL_MS=1000
NOTICE_SCHEDULER_INTERVAL_MS=15000

# Attachment scanner. Compose accepts streamed resource files up to 500 MiB;
# leave headroom in ClamAV and enough time for slow disks/large files.
CLAMAV_TIMEOUT_MS=600000
ATTACHMENT_POLL_MS=1500
ATTACHMENT_LEASE_MS=300000
ATTACHMENT_MAX_ATTEMPTS=3
ATTACHMENT_UPLOAD_CLEANUP_MS=900000
# 이중망 게시물 검사: OFF | SHADOW | ENFORCE
MODERATION_MODE=SHADOW
# openssl rand -hex 32 로 생성하고 외부에 공개하지 마세요.
CODEX_MODERATION_SECRET=
MODERATION_POLL_MS=1500