# Copy to .env and fill in. Never commit .env.
# Generate the two keys with:  docker run --rm mockingbird:local genkeys
#                         or:  openssl rand -hex 32   (twice)
MB_SECRET_KEY=
MB_ENCRYPTION_KEY=

# The URL clients and browsers use to reach the bridge (used in image and
# post links). Plain http is expected: vintage clients cannot do modern TLS.
MB_PUBLIC_URL=http://bird.example.net

# Listeners. Use :80 / :443 if you enabled unprivileged low ports (see
# compose.yaml), otherwise forward those ports to these on your router.
MB_HTTP_ADDR=:80
# Optional TLS 1.0 listener for clients that insist on https (see README).
#MB_LEGACY_TLS_ADDR=:443

# Admin and metrics: loopback and your Tailscale IP only. Wildcards are refused.
MB_ADMIN_ADDR=127.0.0.1:9090
#MB_ADMIN_ADDR=127.0.0.1:9090,100.101.102.103:9090

# Hostnames that are this bridge (defaults to MB_PUBLIC_URL's host). The
# Twitter hostnames are always served too, for DNS-override setups.
#MB_BRIDGE_HOSTS=bird.example.net

# If a reverse proxy sits in front, list its address so X-Forwarded-For is
# trusted. Leave empty when clients connect directly.
#MB_TRUSTED_PROXIES=

# Known OAuth consumers whose signatures should be verified (key:secret,...).
# Unknown consumers are accepted with bearer-token semantics (see README).
#MB_OAUTH_CONSUMERS=

# Image cache size on disk.
#MB_IMAGE_CACHE_MB=512

#MB_LOG_LEVEL=info