# Environment Variables
# Copy this file to .env and update the values
# Only secrets are required - all other settings have defaults in docker-compose.yml

# JWT Secret for authentication (generate a secure random string)
# Generate with: openssl rand -hex 32
JWT_SECRET=your-secure-jwt-secret-key-here

# PostgreSQL database password (the bootstrap superuser account; kept
# for container initialization — the app itself connects as bookhoard_srv)
# Generate with: openssl rand -hex 16
DBPASS=your-secure-database-password-here

# Runtime database role password (bookhoard_srv — the non-superuser
# account the app connects as; subject to RLS). Required for the app to
# start. On a fresh volume it is consumed by database/schema/z_rls_role.sh
# during first initialization; on an existing volume, run that script once
# (see its header) BEFORE starting the app with DATABASE_USER=bookhoard_srv.
# Generate with: openssl rand -hex 16
DBSRVPASS=your-secure-runtime-role-password-here

# Networking: change a port if it conflicts on your host
# Postgres port, host + container (e.g. another local DB already uses 5432)
# DB_PORT=15432
# App web port, host + container
# SERVER_PORT=8765

# Deployment
# External URL for device sync (must include protocol; defaults to http://localhost:8765)
# Examples: https://bookhoard.example.com | http://192.168.1.10:8765
# BASE_URL=https://bookhoard.example.com
# Mark session cookies Secure — set true behind a TLS-terminating reverse proxy (Caddy/nginx/traefik)
# COOKIE_SECURE=true
# Pin or rollback a specific published image version (defaults to "latest")
# IMAGE_TAG=1.0.0

# Optional: Override Defaults (defaults are set in docker-compose.yml)
# Test Mode: WARNING - Only set to true for integration testing
# TEST_MODE=true
# Rate Limiting: Disable or increase limits for testing
# RATE_LIMIT_ENABLED=false
# REQUESTS_PER_MINUTE=1000
# Conversion Tool: Switch from kepubify to ebook-convert
# BOOKHOARD_CONVERSION_TOOL=/usr/bin/ebook-convert
# Conversion Cache TTL: Override default 24h
# BOOKHOARD_CONVERSION_CACHE_TTL=48h
# Archive Retention: days to keep archived items (files missing from disk for
# 2+ scans) before they are purged, deleting their reading history with them.
# Set 0 to keep archived items until purged manually on the library admin page.
# ARCHIVE_RETENTION_DAYS=90
# System timezone (fallback for server-side time operations, defaults to UTC)
# TZ=America/New_York