# instagram-api-free — environment variables
# Copy to .env and fill in values before running.
# Never commit .env to version control.

# ── Storage ──────────────────────────────────────────────────────────────────
# Path where session data (TinyDB JSON) is persisted.
# In Docker, mount a volume at /data and leave this as-is.
AIOGRAPI_REST_DB_PATH=./db.json

# ── Security ─────────────────────────────────────────────────────────────────
# Set a strong random secret to gate all API endpoints behind X-API-Key auth.
# Generate one with: python3 -c "import secrets; print(secrets.token_hex(32))"
# Leave blank to run open (local / trusted-network only).
API_KEY=

# ── Rate limiting ─────────────────────────────────────────────────────────────
# Requests allowed per IP per window. Set RATE_LIMIT_REQUESTS=0 to disable.
# Per-process in-memory only — see aiograpi_rest/ratelimit.py for multi-replica notes.
RATE_LIMIT_REQUESTS=60
RATE_LIMIT_WINDOW=60

# ── Debug ────────────────────────────────────────────────────────────────────
# Set DEBUG=true to enable /docs and /redoc Swagger UI when API_KEY is set.
# PRODUCTION: keep DEBUG=false (default). Never expose Swagger on a public endpoint
# without also setting API_KEY — the UI allows unauthenticated auth/login calls.
DEBUG=false