.env.example

# Whispr server configuration
# The server reads these from its environment; it does not load a .env file by
# itself. Pass them with e.g. `docker run --env-file`, a systemd
# EnvironmentFile (see deploy/systemd), or `set -a; . ./.env; set +a`.

# Server bind address (keep 127.0.0.1 behind a TLS reverse proxy)
HOST=127.0.0.1

# Server port
PORT=8080

# SQLite database path
DATABASE_PATH=whispr.db

# JWT signing secret (min 32 bytes, generated automatically if empty)
JWT_SECRET=

# Optional: separate key for encrypting TOTP seeds (min 32 bytes)
TOTP_ENCRYPTION_KEY=

# Access and refresh token lifetimes
JWT_ACCESS_TTL=24h
JWT_REFRESH_TTL=4320h

# Allowed CORS/WebSocket origins (comma-separated)
ALLOWED_ORIGINS=http://localhost:*

# Trusted proxies for X-Forwarded-For (comma-separated)
TRUSTED_PROXIES=127.0.0.1,::1

# TLS certificate and key (must be set together for native TLS)
TLS_CERT_FILE=
TLS_KEY_FILE=

# Application log file path (empty = stdout/journalctl only)
LOG_FILE=

# Upload storage directory
UPLOAD_DIR=uploads

# Max encrypted attachment storage in MB (0 = unlimited)
ATTACHMENT_STORAGE_LIMIT_MB=360

# Log level: debug, info, warn, error
LOG_LEVEL=warn

# Firebase Cloud Messaging (optional, for Android push notifications)
FCM_CREDENTIALS_FILE=
FCM_PROJECT_ID=