.env.example

# ── ShareSecure Self-Hosted Configuration ──────────────────────────────────

# Server port (default: 3000)
PORT=3000

# Public-facing base URL (used in generated share links)
# Set this to your domain or IP in production
BASE_URL=http://localhost:3000

# Path to data directory (default: ./data)
# This folder will contain the SQLite database and uploaded files
# DATA_DIR=/var/lib/sharesecure

# --- Public Tunnel Options (Local Edition) ---
# Automatically spin up a public localtunnel so you can share files with other devices easily.
USE_LOCAL_TUNNEL=true
# Set a custom personal subdomain (e.g. TUNNEL_SUBDOMAIN=my-personal-files -> https://my-personal-files.loca.lt)
# TUNNEL_SUBDOMAIN=

# AES-256-GCM encryption key for at-rest encryption of files and metadata.
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Leave blank to disable encryption (files stored as plaintext on disk).
# WARNING: Changing this key after uploads will make existing files unreadable.
ENCRYPTION_KEY=

# Optional: override the SQLite database path
# DB_PATH=/var/lib/sharesecure/sharesecure.db

# --- Cloudflare Pages / Turso deployment secrets (set in CF dashboard, not in this file) ---
# TURSO_URL         — libsql:// or https:// URL of your Turso database (falls back to built-in if unset)
# TURSO_TOKEN       — Turso DB auth token
# TOKEN_SECRET      — HMAC secret for signed auth tokens (32+ random bytes hex)
# TAG_SECRET        — HMAC secret for the user→file pseudonym (user_tag); if unset, falls back to TOKEN_SECRET
# Generate TOKEN_SECRET/TAG_SECRET with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"