# Copy to .env for docker compose, or export by hand when running natively.
# .env is git-ignored. Nothing in here is needed for ordinary loopback
# development — the defaults are the development defaults.

# Where the browser reaches the API. Read by the site at build/dev time.
# VITE_API_ORIGIN=http://127.0.0.1:3000

# The API's listen address. The compose file sets its own (0.0.0.0 inside the
# container); natively the default of 127.0.0.1:3000 is correct.
# BIND_ADDR=127.0.0.1:3000

# Log filter for the API, standard tracing-subscriber EnvFilter syntax.
# RUST_LOG=info

# --- login (M2) --------------------------------------------------------------
# All optional in development: unset, the API runs the loopback OAuth client
# with a random per-boot cookie secret.

# The site's origin — the one origin CORS admits and where the OAuth callback
# redirects back to. Exact match, scheme and port included.
# WEB_ORIGIN=http://127.0.0.1:5173

# Where the sqlite file (OAuth sessions — a credential store) lives.
# DB_PATH=./data/headquarters.sqlite

# HMAC key for the session cookie, at least 32 bytes. Required in public mode;
# without it in development, sessions do not survive a restart.
# SESSION_SECRET=

# The userinput.app space flares are filed to, as its at:// URI. Unset,
# /api/flare answers that flares are not enabled.
# FLARE_SPACE=at://did:plc:a2j2g42ai6v65qpbvb6hmubi/app.userinput.space/3msr5yrvtq22g

# helm's index of MegaMek's unit library, which is what tells a match report
# the picture each design is drawn with. Read once at startup; unset, or
# unreachable, and a report draws each machine as its weight class instead.
# The release and the address of its art both come out of the file, so this
# names which index and nothing else.
# UNIT_INDEX_URL=https://lance.blue/assets/helm/0.51.0/units.json

# --- confidential client (public deployments only) ---------------------------
# Setting PUBLIC_URL switches to the confidential client: metadata served at
# PUBLIC_URL/oauth/client-metadata.json, keys at /.well-known/jwks.json,
# Secure cookies. SESSION_SECRET and PRIVATE_KEY_JWK become required.
# PUBLIC_URL=https://api.lance.blue

# Where the public match reports are published, when that is not this service
# itself. The pages live under /reports/, so a CDN in front of the site can
# route that prefix here and a shared match is a lance.blue link; this is what
# the page's og:url, its card and the link a player copies then say. Unset,
# they say PUBLIC_URL.
# SHARE_ORIGIN=https://lance.blue

# Domain attribute for the session cookie. Set, the browser sends the cookie
# to every subdomain, so sibling services holding SESSION_SECRET can verify a
# player themselves — and anything proxying to a match container must strip
# Cookie on the way through. Must cover PUBLIC_URL's host. Unset: host-only.
# COOKIE_DOMAIN=lance.blue

# ES256 private JWK — one object, or an array so a rotation can publish the
# next key before the old one stops signing. Every key needs a "kid". One way
# to mint one:
#   node -e 'const{generateKeyPairSync}=require("crypto");const j=generateKeyPairSync("ec",{namedCurve:"P-256"}).privateKey.export({format:"jwk"});j.kid=Date.now().toString(36);console.log(JSON.stringify(j))'
# PRIVATE_KEY_JWK=

# --- docker compose ----------------------------------------------------------
# Only if your account is not uid/gid 1000.
# HQ_UID=1000
# HQ_GID=1000