# shithub environment example. Copy to .env and edit. .env is gitignored.
#
# Variables follow SHITHUB_<area>_<key> naming so they don't collide with
# system env. Nested config keys are joined with double-underscore in env
# (e.g. database.url -> SHITHUB_DATABASE__URL).

# ----- web -----
SHITHUB_WEB_ADDR=:8080

# ----- database (S01) -----
# Used by `shithubd web`, `shithubd worker`, `shithubd migrate`, etc.
SHITHUB_DATABASE_URL=postgres://shithub:shithub_dev@127.0.0.1:5432/shithub?sslmode=disable

# Used only by tests. The dbtest harness creates per-test DBs cloned from a
# template DB rooted under this server.
SHITHUB_TEST_DATABASE_URL=postgres://shithub:shithub_dev@127.0.0.1:5432/postgres?sslmode=disable

# ----- storage (S04) -----
# Filesystem root for bare git repos. Production: /data/repos on the
# block-storage volume. Dev default below points at a per-user dir.
SHITHUB_STORAGE__REPOS_ROOT=/tmp/shithub-dev/repos

# S3-compatible object storage. Dev defaults target the local MinIO from
# docker-compose. Set non-default credentials in .env (do NOT commit).
SHITHUB_STORAGE__S3__ENDPOINT=127.0.0.1:9000
SHITHUB_STORAGE__S3__REGION=us-east-1
SHITHUB_STORAGE__S3__ACCESS_KEY_ID=shithub-dev
SHITHUB_STORAGE__S3__SECRET_ACCESS_KEY=shithub-dev-secret-please-change
SHITHUB_STORAGE__S3__BUCKET=shithub-dev
SHITHUB_STORAGE__S3__USE_SSL=false
SHITHUB_STORAGE__S3__FORCE_PATH_STYLE=true

# ----- auth (S05) -----
# Set false in dev for fast iteration; keep true in prod.
SHITHUB_AUTH__REQUIRE_EMAIL_VERIFICATION=false
# Used for the link in transactional emails — set to your public origin in prod.
SHITHUB_AUTH__BASE_URL=http://127.0.0.1:8080
SHITHUB_AUTH__SITE_NAME=shithub
SHITHUB_AUTH__EMAIL_FROM=shithub <noreply@shithub.local>
# stdout (default in dev), smtp (MailHog), or postmark.
SHITHUB_AUTH__EMAIL_BACKEND=stdout
# When email_backend=smtp:
SHITHUB_AUTH__SMTP__ADDR=127.0.0.1:1025
# When email_backend=postmark:
# SHITHUB_AUTH__POSTMARK__SERVER_TOKEN=...

# AEAD key for at-rest TOTP secrets (S06). Generate once and persist —
# rotating without re-encrypting every row breaks every existing 2FA login.
# SHITHUB_TOTP_KEY=$(openssl rand -base64 32)

# ----- rate limits (S50 §0) -----
# Per-hour budgets for /api/v1/* requests. Authed keyed by token id;
# anon keyed by remote IP. Zero falls back to the default.
SHITHUB_RATELIMIT__API__AUTHED_PER_HOUR=5000
SHITHUB_RATELIMIT__API__ANON_PER_HOUR=60