HTTP_ADDR=:3000
SMTP_ADDR=:2525
PUBLIC_BASE_URL=http://localhost:3000
# Public crawler indexing policy: none, landing, or docs. Recommended default is
# landing; use none during Safe Browsing recovery and docs after trust recovers.
PUBLIC_INDEXING=landing
MAIL_HOSTNAME=mail.example.com
EXPECTED_MX=mail.example.com
MX_STRICT=false

DATABASE_DRIVER=sqlite
DATABASE_URL=storage/jovemail.db
DB_MAX_OPEN_CONNS=25
DB_MAX_IDLE_CONNS=5
# Optional external frontend override. Release binaries fall back to the
# embedded frontend if this path is missing.
FRONTEND_DIST=web/dist

MAX_MESSAGE_BYTES=10485760
MAX_ATTACHMENT_BYTES=10485760
MESSAGE_RETENTION_HOURS=24
AUDIT_LOG_RETENTION_DAYS=180
AUDIT_ACTIVITY_RETENTION_DAYS=30
INBOUND_SPOOL_RETENTION_DAYS=30
METRICS_ENABLED=false
DISABLE_PENDING_DOMAIN_DATA_PROTECTION=false

DEV_MODE=true
# Required when DEV_MODE=false. Generate a high-entropy value; never commit a real key.
SECRET_ENCRYPTION_KEY=
INBOX_TOKEN_SECRET=replace-with-a-long-random-secret
SESSION_SECRET=replace-with-another-long-random-secret
API_KEY_DEFAULT_DAILY_LIMIT=200000
ALLOW_API_KEY_QUERY_PARAM=false
CONFIG_ENV_PATH=.env

GITHUB_OAUTH_CLIENT_ID=
GITHUB_OAUTH_CLIENT_SECRET=
GITHUB_OAUTH_REDIRECT_URL=
GITHUB_OAUTH_ENABLED=false

LINUXDO_OAUTH_CLIENT_ID=
LINUXDO_OAUTH_CLIENT_SECRET=
LINUXDO_OAUTH_REDIRECT_URL=
LINUXDO_OAUTH_ENABLED=false

# Keep empty for same-origin only.
ALLOWED_ORIGIN=

# Outlook password auto-auth / empty client_id defaults (existing connections are not rewritten).
# Production should prefer a self-registered Azure public client; the built-in ID may be rate-limited.
MICROSOFT_OAUTH_CLIENT_ID=9e5f94bc-e8a4-4e73-b8be-63364c29d753
# Must match the Azure app redirect URI used by the auto-auth authorize/token hops.
MICROSOFT_OAUTH_REDIRECT_URI=http://localhost:8080