.env.example

# Application
PORT=3000
NODE_ENV=development

# Trusted proxy mode: "cloudflare" | "x-forwarded-for" | "none"
TRUSTED_PROXY=cloudflare

# CORS — comma-separated origins, or "*" for all
CORS_ORIGINS=*

# Redis
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=
REDIS_DB=0
REDIS_KEY_PREFIX=hg:

# PoW — challenge validity window (seconds)
POW_CHALLENGE_TTL_SECONDS=300

# PoW — proof token validity window (seconds)
POW_PROOF_TOKEN_TTL_SECONDS=300

# PoW — ES256 signing private key. In development a temporary key is generated
# automatically if neither variable is set. In production you must set exactly one.
# Use a PKCS#8 PEM and preserve newlines, or provide its base64-encoded form.
# POW_TOKEN_PRIVATE_KEY_PEM="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
# POW_TOKEN_PRIVATE_KEY_BASE64=<base64-of-pkcs8-pem>

# PoW — difficulty range for leading-zero bits (SHA-256)
# 20 bits ≈ 1 s · 22 ≈ 4 s · 24 ≈ 16 s (JavaScript browser)
# Default max is 32 bits (~4 billion hashes). Lower for low-powered clients (e.g. mobile).
POW_BASE_DIFFICULTY_BITS=21
POW_MAX_DIFFICULTY_BITS=26

# PoW — suspicious solve: reject if server-observed solve time < N ms (set 0 to disable)
POW_MIN_SOLVE_TIME_MS=50

# PoW — max wrong-nonce retries per challenge before 429
POW_MAX_FAILURES_PER_CHALLENGE=5

# PoW — per-IP challenge issuance hard limit (requests/min); excess receives 429
POW_MAX_CHALLENGE_RPM=60

# PoW — override RPM → extra-bits mapping (JSON array, descending minRpm order)
# Omit to use the built-in default tiers shown below.
# POW_RATE_TIERS_JSON=[{"minRpm":30,"extraBits":6},{"minRpm":20,"extraBits":3},{"minRpm":10,"extraBits":2},{"minRpm":5,"extraBits":1},{"minRpm":0,"extraBits":0}]