.env.example

# Software Release Radar
# Recommended first run:
#   bash scripts/setup.sh
#
# The setup script creates .env with secure application secrets and keeps the
# password itself out of this file.

RADAR_VERSION=2.8.0
RADAR_BIND_ADDRESS=0.0.0.0
RADAR_PORT=9120

# Automatic release checking. Each scheduler cycle only checks trackers that
# are due according to their individual refresh interval.
RADAR_SCHEDULER_INTERVAL_SECONDS=60
RADAR_SCHEDULER_LOG_RESULTS=false
RADAR_LOG_LEVEL=INFO

ADMIN_USERNAME=admin
ADMIN_EMAIL=
ADMIN_PASSWORD_HASH=

SECRET_KEY=
ENCRYPTION_KEY=

# Optional. Raises GitHub API rate limits for release checks.
GITHUB_TOKEN=

# Set true when the application is only accessed over HTTPS.
SESSION_COOKIE_SECURE=false

# Set true only when Release Radar is directly behind one trusted reverse proxy.
TRUST_PROXY_HEADERS=false

# Security controls for optional AI use.
AI_USER_10_MINUTE_LIMIT=10
AI_USER_DAILY_LIMIT=50
AI_IP_HOURLY_LIMIT=30
AI_USER_CONCURRENCY_LIMIT=1
AI_GLOBAL_CONCURRENCY_LIMIT=4
AI_REQUEST_LEASE_SECONDS=180
AI_QUESTION_MAX_CHARS=4000

# Password-reset responses use a minimum response duration to reduce timing
# differences between existing and unknown accounts.
PASSWORD_RESET_MIN_SECONDS=0.35

# Keep false. Setting this to true explicitly accepts cleartext transport for
# credential-bearing HTTP integrations or remote SMTP without TLS.
ALLOW_INSECURE_INTEGRATIONS=false