# ────────────────────────────────────────────────
# RefBoard — Environment Configuration
# Copy this file to `.env` and edit values for your install.
# ────────────────────────────────────────────────

# ---- Server ----
PORT=8000
NODE_ENV=development
CORS_ORIGIN=*

# ---- Container image (Docker Compose only) ----
# Pre-built multi-arch images are published to GHCR on every push to main.
# Pin a release with e.g. ghcr.io/metalfinger/refboard:v0.5.0 — see
# https://github.com/metalfinger/refboard/pkgs/container/refboard for tags.
REFBOARD_IMAGE=ghcr.io/metalfinger/refboard:latest

# ---- JWT auth ----
# OPTIONAL. If unset, RefBoard generates a 64-byte random secret on first boot
# and persists it in the SQLite settings table. Set this env var only if you
# want ops to manage the secret out-of-band (e.g. via a secrets manager) — when
# set, it always overrides the persisted value. Rotate by clearing the env var
# *and* deleting the settings.jwt_secret row; this invalidates existing tokens.
# JWT_SECRET=
JWT_EXPIRES_IN=7d

# ---- SQLite database ----
# Path inside the running process. Defaults to /app/data/refboard.db (Docker).
# For local non-Docker dev, set this to ./data/refboard.db (relative to backend/).
DB_PATH=/app/data/refboard.db

# ---- Object storage ----
# STORAGE_BACKEND=minio (default) — uses MinIO or any S3-compatible store.
# STORAGE_BACKEND=fs            — stores media bytes on the local filesystem
#                                  under STORAGE_DATA_DIR. Collapses the stack
#                                  to a single container; see
#                                  examples/compose/minimal-fs.yml.
STORAGE_BACKEND=minio
STORAGE_DATA_DIR=/app/data/storage

# MinIO settings (ignored when STORAGE_BACKEND=fs)
MINIO_ENDPOINT=minio
MINIO_PORT=9000
MINIO_USE_SSL=false
MINIO_ACCESS_KEY=minioadmin
MINIO_SECRET_KEY=minioadmin
MINIO_BUCKET=refboard

# Public-facing base URL for media. Leave empty to serve via the backend proxy
# (recommended for self-hosted single-box installs).
PUBLIC_URL=

# Max upload size in MB (per file). Defaults to 200.
MAX_FILE_SIZE_MB=200

# ---- First-run admin bootstrap ----
# When the server starts and no user with this email exists, RefBoard will
# create one with role=admin. Idempotent — runs every boot but only seeds once.
# Leave blank to skip seeding.
SEED_ADMIN_EMAIL=
SEED_ADMIN_PASSWORD=
SEED_ADMIN_USERNAME=
SEED_ADMIN_DISPLAY_NAME=

# ---- Self-registration ----
# Initial value for the runtime self-registration toggle. Default "false".
# After the first boot this env var is IGNORED — admins control the toggle
# from the dashboard at /admin (it's persisted in the database).
# The very first user can always register, regardless of this flag, and is
# auto-promoted to admin.
ALLOW_SELF_REGISTRATION=false

# ---- Optional: API key for bot / programmatic upload ----
# If set, /api/upload/api-key endpoints require this header value.
REFBOARD_API_KEY=