# PDS this dashboard manages
PDS_HOSTNAME=pds.example.com
PDS_ADMIN_PASSWORD=changeme
# For a PDS without an admin password (e.g. tranquil-pds): set this to the handle or DID
# of an account with admin rights. PDS_ADMIN_PASSWORD is then that account's password
# (an app password works). Leave empty for the reference PDS.
PDS_ADMIN_IDENTIFIER=

# Relay used for sync status / requestCrawl
RELAY_HOSTNAME=bsky.network

# Dashboard's own operator login (bcrypt hash, generate with:
#   node -e "console.log(require('bcryptjs').hashSync('<password>', 10))" )
# Optional: leave unset for passkey-only sign-in (enroll via: npm run enroll)
OPERATOR_PASSWORD_HASH=changeme
# openssl rand -hex 32 — production refuses to boot on a weak value
SESSION_SECRET=changeme

PORT=8787

# In production the server binds to 127.0.0.1 (reverse-proxy only); override if needed
# HOST=127.0.0.1

# Web client used for profile links in the UI
APPVIEW_URL=https://bsky.app

# Flag notifications via Bluesky DM — fill all four to enable.
# NOTIFY_APP_PASSWORD must be an app password created WITH direct-message access.
NOTIFY_HANDLE=
NOTIFY_APP_PASSWORD=
NOTIFY_RECIPIENT=
DASHBOARD_URL=http://localhost:5173

# With DMs enabled, also alert when one account creates this many records within the
# window (spam bursts). Defaults shown; set ACTIVITY_ALERT_CREATES=0 to disable.
# ACTIVITY_ALERT_CREATES=500
# ACTIVITY_ALERT_WINDOW_MINUTES=60

# Audit log location (defaults to server/audit.log)
# AUDIT_LOG_PATH=/var/log/pds-operator/audit.log