# Required for the MVP access gate. This is the single gate in front of an SSH
# proxy, so it must be a strong random token (min 24 UTF-16 code units) with no
# leading or trailing whitespace. Known weak placeholders and exact repetitions are
# rejected at boot. Generate one with:
#   openssl rand -base64 32
OMXTERM_ACCESS_TOKEN=change-me

# Browser origin(s) allowed to open terminal WebSockets. Comma-separated for
# more than one (e.g. localhost + a LAN IP). Each must be an exact
# scheme://host[:port] with no trailing slash; the wildcard "*" is rejected at
# boot. Reaching the broker from another device also needs OMXTERM_SERVER_HOST,
# and over an untrusted network HTTPS + OMXTERM_SECURE_COOKIES (see issue #5).
OMXTERM_ALLOWED_ORIGIN=http://localhost:5173
# OMXTERM_ALLOWED_ORIGIN=http://localhost:5173,http://192.168.0.10:5173

# Server bind settings.
OMXTERM_SERVER_HOST=127.0.0.1
OMXTERM_SERVER_PORT=3000

# Compose-only broker container ceilings. These non-secret values apply to both
# portable and production Compose paths; direct `npm run dev` is unaffected.
# Defaults leave headroom for the documented 50 global WebSocket cap, Node/V8
# startup and shutdown work, and the healthcheck process. Keep overrides finite
# and positive; see docs/deploy.md for sizing and exhaustion behavior.
OMXTERM_BROKER_MEMORY_LIMIT=512m
OMXTERM_BROKER_PIDS_LIMIT=256
OMXTERM_BROKER_NOFILE_LIMIT=4096

# SSH egress allowlist (SSRF guard, see issue #4). Comma-separated unscoped
# IPv4/IPv6 CIDRs the broker may connect to; a bare address counts as one host.
# Scoped IPv6 and IPv4-mapped IPv6 entries fail at boot; express mapped targets
# with their equivalent IPv4 CIDR/address. Leave this UNSET to allow any target
# (fine for single-user/localhost). Once set it is default-deny: every resolved
# address must pass its exact-family policy, so loopback, link-local
# (169.254.169.254 cloud metadata), and the public internet are blocked unless
# listed. Set this before using the broker as a jump host on a shared network.
# OMXTERM_SSH_ALLOWED_CIDR=10.0.0.0/24

# Cookie security. The auth cookies ARE the authentication, so set this true on
# any deploy reachable over an untrusted network (HTTPS/WSS required). The server
# refuses to boot if this is false while OMXTERM_SERVER_HOST is non-loopback, so
# nobody ships the cookies in cleartext by accident (see issue #5).
OMXTERM_SECURE_COOKIES=false

# Trust the reverse proxy in front of OMXTerm Web (e.g. Traefik terminating TLS).
# Needed so request.ip is the real client (rate limiting) and HTTPS is detected.
# Accepts: true | false | a trusted proxy IP/CIDR allowlist. Numeric proxy hop
# counts are rejected because a direct peer can rotate X-Forwarded-For through
# that trust mode and bypass per-client limits.
# Prefer the proxy's address over a blanket "true" if the server port is exposed.
# OMXTERM_TRUST_PROXY=true

# Optional metadata-only audit log file.
# OMXTERM_AUDIT_LOG=./logs/audit.jsonl

# Serve the built SPA from the broker (single origin). The path is canonicalized
# at boot and must be a directory with a readable regular non-symlink index.html;
# hidden URL path segments are denied. Leave it UNSET in local dev, where Vite
# serves the web and proxies the API. The Docker image sets it to
# /app/apps/web/dist automatically (see docs/deploy.md).
# OMXTERM_WEB_ROOT=./apps/web/dist