# App
PORT=3001

# Optional instance prefix for running multiple copies on one host.
# Isolates Docker volumes/networks (project name: bray-scenarios-{prefix}).
# Quickstart creates ./{prefix}/ when set (run from the directory where you want the install).
# Set PORT and APP_URL manually per instance (e.g. PORT=3002, APP_URL=http://localhost:3002).
# APP_INSTANCE_PREFIX=

# Database (hostname "db" is the Docker Compose Postgres service)
DATABASE_URL=postgresql://postgres:postgres@db:5432/roleplay_app
MEDIA_DIR=/app/data/media 

# Authentication protocol: local | oidc | saml
AUTH_PROTOCOL=local
JWT_SECRET=

# Optional: seed a default admin on init (omit both to use first-run setup UI instead).
# ADMIN_EMAIL=
# ADMIN_PASSWORD=

# Public URL users open in the browser (SPA + SSO callbacks). Also used as a CORS allowlist entry.
# Docker serves API and frontend on the same port — use http://localhost:3001 locally.
# For SSO with a tunnel, set this to your HTTPS public URL (see docs/DOCKER.md).
APP_URL=http://localhost:3001
# Optional comma-separated extra browser origins allowed by CORS (in addition to APP_URL).
# CORS_ORIGINS=

# OIDC / SSO — set AUTH_PROTOCOL=oidc
#AUTH_PROTOCOL=oidc
#OIDC_CLIENT_ID=
#OIDC_CLIENT_SECRET=
#OIDC_ISSUER_URL=
#OIDC_PROVIDER_NAME=SSO
#OIDC_SCOPES=openid email profile
# Register this redirect URI with your IdP:
# http://localhost:3001/api/auth/oidc/callback
# OIDC_REDIRECT_URI=http://localhost:3001/api/auth/oidc/callback

# SAML / SSO — set AUTH_PROTOCOL=saml
# SAML_PROVIDER_NAME=Google
# SAML_IDP_METADATA=
# SAML_SP_ENTITY_ID=
# SAML_ACS_URL=
# Persisted via Docker volume (see docker-compose.yml)
SAML_SP_CERT_DIR=/app/data/saml
# SAML_GOOGLE_HD=yourcompany.com

# Logging: TRACE | DEBUG | INFO | WARN | ERROR (default: INFO)
LOG_LEVEL=INFO

# Rate limiting (DoS protection). Window applies to both global and auth limiters.
# RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX=5000
AUTH_RATE_LIMIT_MAX=100
# Set when running behind a reverse proxy so limits use the real client IP:
# TRUST_PROXY=1

# Optional fallback LLM keys (prefer admin UI at /settings/ai)
# OPENAI_API_KEY=
# ANTHROPIC_API_KEY=
# GOOGLE_API_KEY=

# Development only — type CHEAT MODE: <outcome> in the conversation when enabled.
# CHEAT_MODE=true