# BoxBox environment configuration
# Copy this file to .env and customize it before deploying.

# ===========================================
# Security Settings (CHANGE THESE!)
# ===========================================

# JWT secret for authentication. Use a long random string.
# Generate with: openssl rand -base64 32
BOXBOX_JWT_SECRET=change-me-in-production-use-a-long-random-string

# Bcrypt password hash. Generate one with:
#   htpasswd -bnBC 12 admin 'your-password' | cut -d: -f2
# Keep the value single-quoted so Docker Compose treats "$" literally.
# Additional users can be added as BOXBOX_USERS_<username>.
BOXBOX_USERS_admin='replace-with-a-bcrypt-hash'

# ===========================================
# Deployment Settings
# ===========================================

# Host port published by docker-compose.yml.
HOST_PORT=8080

# Container image used by docker-compose.yml.
BOXBOX_IMAGE=ghcr.io/jr4dh3y/boxbox:v0.3.1

# Optional: override the server port inside the container.
# The container listens on 8080 by default (unprivileged, no extra caps needed).
# BOXBOX_PORT=8080

# ===========================================
# Rate Limiting
# ===========================================

# Auth endpoint rate limit (requests per second per IP)
# Set to 0 to disable rate limiting
BOXBOX_RATE_LIMIT_RPS=2

# ===========================================
# CORS / WebSocket Origins
# ===========================================

# Allowed origins for WebSocket connections
# Leave empty for same-origin only.
# Format: comma-separated list
# Supports wildcards: *.example.com. A literal * explicitly allows all
# origins and weakens cross-site WebSocket protections.
# Example: BOXBOX_ALLOWED_ORIGINS=http://localhost:8080,https://files.example.com
BOXBOX_ALLOWED_ORIGINS=

# Only listed proxy IPs/CIDRs may supply X-Forwarded-For/X-Real-IP.
# Example for a private reverse proxy network:
# BOXBOX_TRUSTED_PROXIES=172.18.0.0/16
BOXBOX_TRUSTED_PROXIES=

# ===========================================
# Mount Settings
# ===========================================

# Host home directory to expose as /home/user in the container.
# Leave unset to use the HOME of the user running docker compose.
# HOME_PATH=/home/your-user

# Optional quick-access folder overrides.
# By default docker-compose maps these to HOME_PATH/Desktop, HOME_PATH/Downloads, etc.
# If HOME_PATH is unset, it uses $HOME/Desktop, $HOME/Downloads, etc.
# Uncomment any line to point that sidebar shortcut at a custom host path.
# DESKTOP_PATH=/home/your-user/Desktop
# DOWNLOADS_PATH=/home/your-user/Downloads
# DOCUMENTS_PATH=/home/your-user/Documents
# MUSIC_PATH=/home/your-user/Music
# PICTURES_PATH=/home/your-user/Pictures
# VIDEOS_PATH=/home/your-user/Videos

# ===========================================
# Optional: User/Group ID Mapping
# ===========================================
# If you need specific UID/GID for file permissions
# Uncomment and set these values

PUID=10001
PGID=10001

# Bind mounts must be readable/writable by this UID/GID. Changing these IDs
# does not chown host paths or existing named volumes automatically.