.env.example

# brainstorm-sync node config.
# Copy to .env for local runs. The node holds no VAULT keys; the only secret
# here is the bucket's transport credential (S3) — never a key that can decrypt
# content.

# Listen port for the WebSocket relay + /healthz.
PORT=7780

# Optional NDJSON audit sink. Records routing metadata ONLY (fromConnId,
# toConnId, entityId, kind, bytes, ts) — never ciphertext. Unset = no file sink.
# AUDIT_LOG_PATH=/var/log/brainstorm-sync/audit.ndjson

# "info" (default) or "debug" (per-connection subscribe/route logging).
LOG_LEVEL=info

# ── SYNC-3: storage provider (one wire protocol, swappable backend) ──────────
# Unset everything ⇒ forward-only (SYNC-1): no durability, no restore.
#
# Local durable (the OQ-SYNC-1 default / self-hosted single box):
# STORAGE_DIR=/var/lib/brainstorm-sync
#
# Object storage (our managed bucket, or a self-hoster's bring-your-own
# S3 / Cloudflare R2 / MinIO bucket). Inferred when S3_BUCKET is set, or force
# with STORAGE_BACKEND=s3.
# STORAGE_BACKEND=s3
# S3_BUCKET=brainstorm-sync
# S3_ENDPOINT=https://<accountid>.r2.cloudflarestorage.com   # omit for AWS S3
# S3_REGION=auto
# S3_ACCESS_KEY_ID=...
# S3_SECRET_ACCESS_KEY=...
# S3_PREFIX=node1/                                           # optional namespace

# ── SYNC-4b: entitlement-gated admission (the brainstorm-cloud seam) ─────────
# PRESENT ⇒ the node is GATED: every connection must complete the token +
# identity handshake before it can emit / subscribe / query. Unset ⇒ open
# admission (dev / the forward node). JSON map of kid → base64url Ed25519
# public key (the billing-edge signer's verify keys; >1 entry during rotation).
# ENTITLEMENT_KEYS={"k1":"<base64url-ed25519-pubkey>"}
# REQUIRE_FEATURE=hosted-relay      # require this token feature flag to admit
# AUTH_TIMEOUT_MS=10000             # close a connection that never authenticates
# METERING_LOG_PATH=/var/log/brainstorm-sync/metering.ndjson   # usage events

# ── SYNC-5: abuse caps / rate limits (ON by default) ─────────────────────────
# LIMITS_DISABLED=1   # turn OFF all caps + rate limits (tests / trusted nets)

# ── Asset-B6: attachment-chunk GC (conservative mark-and-sweep) ──────────────
# Ref tracking is always on when storage is configured; the periodic sweep is
# opt-in. Both windows guard against offline peers — shrink them with care.
# ASSET_GC_GRACE_MS=2592000000        # mark → delete grace window (30 days)
# ASSET_GC_RETENTION_MS=7776000000    # device last-seen retention (90 days)
# ASSET_GC_SWEEP_INTERVAL_MS=86400000 # periodic sweep; unset/0 = manual only